aab79fbfd65ae83447621a5952aacab57477f589cb2048913415c6d170fffe35

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
evasion

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	SevenCopy.exe

Deletes itself 1 IoCs

Processes:

SevenCopy.exe

pid process

1312 SevenCopy.exe

Executes dropped EXE 64 IoCs

Processes:

pid	process
1312	SevenCopy.exe
14956	SevenCopy.exe
18832	SevenCopy.exe
18412	SevenCopy.exe
17644	SevenCopy.exe
17992	SevenCopy.exe
10244	SevenCopy.exe
6460	SevenCopy.exe
13252	SevenCopy.exe
9596	SevenCopy.exe
2416	SevenCopy.exe
4992	SevenCopy.exe
6852	SevenCopy.exe
14320	SevenCopy.exe
13932	SevenCopy.exe
11816	SevenCopy.exe
11980	SevenCopy.exe
5568	SevenCopy.exe
2164	SevenCopy.exe
11324	SevenCopy.exe
8452	SevenCopy.exe
5252	SevenCopy.exe
1284	SevenCopy.exe
6116	SevenCopy.exe
6580	SevenCopy.exe
15264	SevenCopy.exe
9696	SevenCopy.exe
5608	SevenCopy.exe
10412	SevenCopy.exe
10880	SevenCopy.exe
8600	SevenCopy.exe
7800	SevenCopy.exe
7912	SevenCopy.exe
2260	SevenCopy.exe
11936	SevenCopy.exe
13052	SevenCopy.exe
10584	SevenCopy.exe
8948	SevenCopy.exe
13520	SevenCopy.exe
6492	SevenCopy.exe
15252	SevenCopy.exe
6012	SevenCopy.exe
11908	SevenCopy.exe
15324	SevenCopy.exe
11660	SevenCopy.exe
11404	SevenCopy.exe
5248	SevenCopy.exe
15200	SevenCopy.exe
6744	SevenCopy.exe
15380	SevenCopy.exe
5596	SevenCopy.exe
13152	SevenCopy.exe
5264	SevenCopy.exe
9876	SevenCopy.exe
2648	SevenCopy.exe
7180	SevenCopy.exe
8024	SevenCopy.exe
11360	SevenCopy.exe
9740	SevenCopy.exe
16252	SevenCopy.exe
7000	SevenCopy.exe
3732	SevenCopy.exe
16380	SevenCopy.exe
4976	SevenCopy.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

Processes:

OneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

OneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDrive.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

Seven.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

SevenCopy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe

Drops file in System32 directory 64 IoCs

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

description	ioc	process
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXEOneDrive.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

OneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe

Modifies registry class 64 IoCs

Processes:

OneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\ = "FileSync ThumbnailProvider"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{02C98E2C-6C9F-49F8-9B57-3A6E1AA09A67}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\ = "BannerNotificationHandler Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\VersionIndependentProgID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\ = "ISyncEngineCOMServer"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ = "ISyncEngineBandwidthLimiter"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\VersionIndependentProgID	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\VersionIndependentProgID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\ = "SyncEngineStorageProviderHandlerProxy Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{385ED83D-B50C-4580-B2C3-9E64DBE7F511}\ = "IItemActivityCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\ = "SyncEngineCOMServer Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\FileSyncClient.AutoPlayHandler\shell\import\DropTarget	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\ = "IFileSyncClient8"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\ = "IOneDriveInfoProvider"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\0\win32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\VersionIndependentProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy\CurVer	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy\ = "SyncEngineStorageProviderHandlerProxy Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\ = "ICheckFileHashCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VersionIndependentProgID\ = "OOBERequestHandler.OOBERequestHandler"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\HELPDIR	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ = "IMapLibraryCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\ProxyStubClsid32	OneDrive.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

18036 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

WINWORD.EXEOneDrive.exe

pid process

13028 WINWORD.EXE
13028 WINWORD.EXE
15184 OneDrive.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeOneDrive.exe

pid process

3424 powershell.exe
3424 powershell.exe
15184 OneDrive.exe
15184 OneDrive.exe

pid	process
18036	NOTEPAD.EXE

pid	process
13028	WINWORD.EXE
13028	WINWORD.EXE
15184	OneDrive.exe

pid	process
3424	powershell.exe
3424	powershell.exe
15184	OneDrive.exe
15184	OneDrive.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeBackupPrivilege	18780	svchost.exe
Token: SeRestorePrivilege	18780	svchost.exe
Token: SeSecurityPrivilege	18780	svchost.exe
Token: SeTakeOwnershipPrivilege	18780	svchost.exe
Token: 35	18780	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

OneDrive.exe

pid process

15184 OneDrive.exe
15184 OneDrive.exe
15184 OneDrive.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

OneDrive.exe

pid process

15184 OneDrive.exe
15184 OneDrive.exe
15184 OneDrive.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXEOneDrive.exe

pid process

13028 WINWORD.EXE
13028 WINWORD.EXE
13028 WINWORD.EXE
13028 WINWORD.EXE
13028 WINWORD.EXE
13028 WINWORD.EXE
15184 OneDrive.exe

pid	process
15184	OneDrive.exe
15184	OneDrive.exe
15184	OneDrive.exe

pid	process
15184	OneDrive.exe
15184	OneDrive.exe
15184	OneDrive.exe

pid	process
13028	WINWORD.EXE
13028	WINWORD.EXE
13028	WINWORD.EXE
13028	WINWORD.EXE
13028	WINWORD.EXE
13028	WINWORD.EXE
15184	OneDrive.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2612 wrote to memory of 3424	2612	Seven.exe	powershell.exe
PID 2612 wrote to memory of 3424	2612	Seven.exe	powershell.exe
PID 2612 wrote to memory of 2156	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 2156	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 4720	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 4720	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 4376	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 4376	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 5036	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 5036	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 1284	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 1284	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 4292	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 4292	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 2636	2612	Seven.exe	cmd.exe
PID 2612 wrote to memory of 2636	2612	Seven.exe	cmd.exe
PID 4376 wrote to memory of 2716	4376	cmd.exe	attrib.exe
PID 4376 wrote to memory of 2716	4376	cmd.exe	attrib.exe
PID 4292 wrote to memory of 4864	4292	cmd.exe	attrib.exe
PID 4292 wrote to memory of 4864	4292	cmd.exe	attrib.exe
PID 2636 wrote to memory of 3112	2636	cmd.exe	attrib.exe
PID 2636 wrote to memory of 3112	2636	cmd.exe	attrib.exe
PID 2612 wrote to memory of 1312	2612	Seven.exe	SevenCopy.exe
PID 2612 wrote to memory of 1312	2612	Seven.exe	SevenCopy.exe
PID 1312 wrote to memory of 3760	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 3760	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 4616	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 4616	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1072	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1072	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 3412	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 3412	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 916	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 916	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 4164	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 4164	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 884	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 884	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1508	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1508	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 3104	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 3104	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1460	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1460	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1620	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1620	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 4752	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 4752	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1856	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 1856	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 732	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 732	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 2704	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 2704	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 548	1312	SevenCopy.exe	cmd.exe
PID 1312 wrote to memory of 548	1312	SevenCopy.exe	cmd.exe
PID 4616 wrote to memory of 2268	4616	cmd.exe	choice.exe
PID 4616 wrote to memory of 2268	4616	cmd.exe	choice.exe
PID 4752 wrote to memory of 2740	4752	cmd.exe	choice.exe
PID 4752 wrote to memory of 2740	4752	cmd.exe	choice.exe
PID 3760 wrote to memory of 3084	3760	cmd.exe	choice.exe
PID 3760 wrote to memory of 3084	3760	cmd.exe	choice.exe
PID 916 wrote to memory of 712	916	cmd.exe	choice.exe
PID 916 wrote to memory of 712	916	cmd.exe	choice.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

3112 attrib.exe
4864 attrib.exe
2716 attrib.exe

pid	process
3112	attrib.exe
4864	attrib.exe
2716	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
2⤵
PID:2156

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
2⤵
- Drops file in System32 directory
PID:4720

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\SevenCopy.exe
3⤵
- Views/modifies file attributes
PID:2716

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
2⤵
PID:5036

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Drops file in System32 directory
PID:1284

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.dll
3⤵
- Views/modifies file attributes
PID:4864

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.runtimeconfig.json
3⤵
- Views/modifies file attributes
PID:3112

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
3⤵
- Suspicious use of WriteProcessMemory
PID:4616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
3⤵
PID:1072

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
3⤵
PID:3412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:712

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
3⤵
PID:4164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
3⤵
PID:884

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3048

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
3⤵
PID:1508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:3104

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:1460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:1620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:976

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:1856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:2704

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
3⤵
PID:2392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5468

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\RenameUninstall.odt"
3⤵
PID:1020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6952

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\SaveUnregister.png"
3⤵
PID:2260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\UseGrant.jpg"
3⤵
PID:3808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8712

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
3⤵
PID:1572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ConvertToRead.html"
3⤵
PID:812

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
3⤵
PID:2000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
3⤵
PID:4736

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
3⤵
PID:3720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8680

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\TestClose.doc"
3⤵
PID:3892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9648

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
3⤵
PID:4612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UseAssert.docx"
3⤵
PID:1884

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\DismountReset.asp"
3⤵
PID:2240

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\MoveClear.pptx"
3⤵
PID:2860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SubmitPop.csv"
3⤵
PID:2876

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SubmitProtect.docx"
3⤵
PID:2428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UninstallPush.txt"
3⤵
PID:2952

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
3⤵
PID:456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
3⤵
PID:2592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2224

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\FormatClose.doc"
3⤵
PID:2684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\MountLimit.odt"
3⤵
PID:1612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\SelectGet.html"
3⤵
PID:3576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\CompareGet.jpg"
3⤵
PID:4156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\FindMeasure.bmp"
3⤵
PID:440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15828

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
3⤵
PID:748

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\TraceUndo.png"
3⤵
PID:3400

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15480

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\OpenSkip.txt"
3⤵
PID:4100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713511184.txt"
3⤵
PID:4328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
3⤵
PID:5048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29AC.txt"
3⤵
PID:2012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29CD.txt"
3⤵
PID:2104

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29AC.txt"
3⤵
PID:4920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14680

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29CD.txt"
3⤵
PID:4320

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
3⤵
PID:408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
3⤵
PID:2380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15316

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_071507928.html"
3⤵
PID:5132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15308

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
3⤵
PID:5152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
3⤵
PID:5180

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
3⤵
PID:5192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
3⤵
PID:5212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
3⤵
PID:5224

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
3⤵
PID:5240

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
3⤵
PID:5268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15248

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
3⤵
PID:5288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
3⤵
PID:5312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
3⤵
PID:5328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15432

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
3⤵
PID:5344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
3⤵
PID:5372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4164

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
3⤵
PID:5396

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15240

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
3⤵
PID:5416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
3⤵
PID:5428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
3⤵
PID:5460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
3⤵
PID:5472

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11812

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
3⤵
PID:5488

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
3⤵
PID:5504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15760

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
3⤵
PID:5516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
3⤵
PID:5528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
3⤵
PID:5540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9688

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
3⤵
PID:5552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15384

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
3⤵
PID:5568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
3⤵
PID:5580

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
3⤵
PID:5592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
3⤵
PID:5604

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
3⤵
PID:5620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15520

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
3⤵
PID:5632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15576

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
3⤵
PID:5644

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15452

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
3⤵
PID:5656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
3⤵
PID:5676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
3⤵
PID:5696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
3⤵
PID:5716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
3⤵
PID:5736

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
3⤵
PID:5752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
3⤵
PID:5772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
3⤵
PID:5784

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
3⤵
PID:5808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
3⤵
PID:5824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
3⤵
PID:5852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
3⤵
PID:5868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
3⤵
PID:5892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
3⤵
PID:5912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15348

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
3⤵
PID:5936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
3⤵
PID:5948

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10940

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
3⤵
PID:5972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
3⤵
PID:5988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
3⤵
PID:6000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
3⤵
PID:6012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14164

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
3⤵
PID:6024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
3⤵
PID:6036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
3⤵
PID:6048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7712

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
3⤵
PID:6064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
3⤵
PID:6080

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
3⤵
PID:6096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
3⤵
PID:6112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
3⤵
PID:6128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15776

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
3⤵
PID:4504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
3⤵
PID:3992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15292

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
3⤵
PID:5384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
3⤵
PID:6152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
3⤵
PID:6172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
3⤵
PID:6196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
3⤵
PID:6212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10316

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
3⤵
PID:6228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
3⤵
PID:6240

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
3⤵
PID:6252

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
3⤵
PID:6264

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
3⤵
PID:6276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14292

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
3⤵
PID:6288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
3⤵
PID:6300

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12536

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
3⤵
PID:6316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3688

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
3⤵
PID:6328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
3⤵
PID:6340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
3⤵
PID:6352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10428

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
3⤵
PID:6364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
3⤵
PID:6376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10476

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
3⤵
PID:6392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
3⤵
PID:6408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15940

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
3⤵
PID:6420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14308

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
3⤵
PID:6432

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
3⤵
PID:6448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
3⤵
PID:6460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
3⤵
PID:6480

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4992

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
3⤵
PID:6492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
3⤵
PID:6516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15784

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
3⤵
PID:6528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
3⤵
PID:6556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
3⤵
PID:6568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11648

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
3⤵
PID:6596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
3⤵
PID:6616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11688

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
3⤵
PID:6648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839446140267.txt"
3⤵
PID:6664

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840135824682.txt"
3⤵
PID:6684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840503567844.txt"
3⤵
PID:6704

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840700580475.txt"
3⤵
PID:6728

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14020

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840746051862.txt"
3⤵
PID:6752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840805647182.txt"
3⤵
PID:6780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579841000679404.txt"
3⤵
PID:6800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579841044461171.txt"
3⤵
PID:6828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579841103643755.txt"
3⤵
PID:6848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844203170839.txt"
3⤵
PID:6868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847726247611.txt"
3⤵
PID:6880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15792

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848027779190.txt"
3⤵
PID:6892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848328601309.txt"
3⤵
PID:6904

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848720705765.txt"
3⤵
PID:6916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579849175070968.txt"
3⤵
PID:6928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579849319456479.txt"
3⤵
PID:6944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579850631342657.txt"
3⤵
PID:6956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579850930939937.txt"
3⤵
PID:6968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579851238643505.txt"
3⤵
PID:6980

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579851531594146.txt"
3⤵
PID:6992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579852325460694.txt"
3⤵
PID:7004

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4720

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579867889484743.txt"
3⤵
PID:7016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:884

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
3⤵
PID:7028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
3⤵
PID:7044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:7056

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\pkcs11.txt"
3⤵
PID:7068

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\known_providers_download_v1[1].xml"
3⤵
PID:7080

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\update100[1].xml"
3⤵
PID:7092

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
3⤵
PID:7104

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
3⤵
PID:7116

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15556

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
3⤵
PID:7140

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9020

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
3⤵
PID:7152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
3⤵
PID:5480

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11728

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
3⤵
PID:7292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5100

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
3⤵
PID:7372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
3⤵
PID:7392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{51622a83-c5a1-47aa-894c-769a99748b42}\0.0.filtertrie.intermediate.txt"
3⤵
PID:7412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{51622a83-c5a1-47aa-894c-769a99748b42}\0.1.filtertrie.intermediate.txt"
3⤵
PID:5500

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15672

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{51622a83-c5a1-47aa-894c-769a99748b42}\0.2.filtertrie.intermediate.txt"
3⤵
PID:5564

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9453cd26-6cda-4e6c-9a3d-9172785aeaa5}\0.0.filtertrie.intermediate.txt"
3⤵
PID:5628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9453cd26-6cda-4e6c-9a3d-9172785aeaa5}\0.1.filtertrie.intermediate.txt"
3⤵
PID:5748

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9453cd26-6cda-4e6c-9a3d-9172785aeaa5}\0.2.filtertrie.intermediate.txt"
3⤵
PID:5908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fd820bc5-80b5-4018-af8a-9c592792a5b5}\0.0.filtertrie.intermediate.txt"
3⤵
PID:6060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fd820bc5-80b5-4018-af8a-9c592792a5b5}\0.1.filtertrie.intermediate.txt"
3⤵
PID:6236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fd820bc5-80b5-4018-af8a-9c592792a5b5}\0.2.filtertrie.intermediate.txt"
3⤵
PID:6272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\appsconversions.txt"
3⤵
PID:6312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15720

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\appsglobals.txt"
3⤵
PID:6348

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\appssynonyms.txt"
3⤵
PID:6388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\settingsconversions.txt"
3⤵
PID:6776

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15860

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\settingsglobals.txt"
3⤵
PID:6504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\settingssynonyms.txt"
3⤵
PID:6592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0dc5dae9-fb25-4269-96d8-d7c2b39a1144}\0.0.filtertrie.intermediate.txt"
3⤵
PID:6612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0dc5dae9-fb25-4269-96d8-d7c2b39a1144}\0.1.filtertrie.intermediate.txt"
3⤵
PID:9048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0dc5dae9-fb25-4269-96d8-d7c2b39a1144}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.0.filtertrie.intermediate.txt"
3⤵
PID:9084

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.1.filtertrie.intermediate.txt"
3⤵
PID:9100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
3⤵
PID:9136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2940

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
3⤵
PID:9152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
3⤵
PID:9164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
3⤵
PID:9176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
3⤵
PID:9188

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16052

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
3⤵
PID:7940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
3⤵
PID:8992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16040

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
3⤵
PID:6372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
3⤵
PID:6900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
3⤵
PID:7380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
3⤵
PID:9228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
3⤵
PID:9612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
3⤵
PID:9868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
3⤵
PID:9888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15172

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
3⤵
PID:9916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
3⤵
PID:9936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
3⤵
PID:9948

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15040

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
3⤵
PID:9960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ART8LJX\microsoft.windows[1].xml"
3⤵
PID:9972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZMTSYCJM\www.bing[1].xml"
3⤵
PID:9984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
3⤵
PID:9996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
3⤵
PID:10016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
3⤵
PID:10036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
3⤵
PID:10048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
3⤵
PID:10064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
3⤵
PID:10076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
3⤵
PID:10100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16580

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
3⤵
PID:10120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3052

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
3⤵
PID:10148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
3⤵
PID:10168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16520

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
3⤵
PID:10184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
3⤵
PID:10196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4040

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
3⤵
PID:10220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16544

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
3⤵
PID:8240

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
3⤵
PID:5536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16476

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
3⤵
PID:6660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
3⤵
PID:6552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
3⤵
PID:7756

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
3⤵
PID:9160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
3⤵
PID:7664

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
3⤵
PID:10252

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
3⤵
PID:10272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
3⤵
PID:10300

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
3⤵
PID:10336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15140

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
3⤵
PID:10364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
3⤵
PID:10376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4348

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
3⤵
PID:10388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
3⤵
PID:10400

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
3⤵
PID:10420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
3⤵
PID:10464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
3⤵
PID:10488

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
3⤵
PID:10504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16536

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
3⤵
PID:10524

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
3⤵
PID:10536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
3⤵
PID:10548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
3⤵
PID:10572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
3⤵
PID:10596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
3⤵
PID:10612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16528

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
3⤵
PID:10628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
3⤵
PID:10640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1140

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
3⤵
PID:10656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
3⤵
PID:10668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
3⤵
PID:10684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
3⤵
PID:10700

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
3⤵
PID:10728

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
3⤵
PID:10740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
3⤵
PID:10752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
3⤵
PID:10764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
3⤵
PID:10776

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
3⤵
PID:10788

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15680

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:14956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
4⤵
PID:17148

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
4⤵
PID:17164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\OpenSkip.txt"
4⤵
PID:17180

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713511184.txt"
4⤵
PID:17196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19388

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
4⤵
PID:17212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29AC.txt"
4⤵
PID:17228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29CD.txt"
4⤵
PID:17244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29AC.txt"
4⤵
PID:17260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29CD.txt"
4⤵
PID:17276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
4⤵
PID:17292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
4⤵
PID:17308

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_071507928.html"
4⤵
PID:17324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
4⤵
PID:17340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
4⤵
PID:17356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19292

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
4⤵
PID:17372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
4⤵
PID:17388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
4⤵
PID:17404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
4⤵
PID:17120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19184

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
4⤵
PID:17136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:17848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
4⤵
PID:17804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
4⤵
PID:17820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
4⤵
PID:17836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
4⤵
PID:17852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
4⤵
PID:17868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
4⤵
PID:17884

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
4⤵
PID:17900

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
4⤵
PID:17916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
4⤵
PID:17932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
4⤵
PID:17948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
4⤵
PID:17964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
4⤵
PID:17980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
4⤵
PID:17996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
4⤵
PID:18012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
4⤵
PID:18028

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
4⤵
PID:18044

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
4⤵
PID:18060

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
4⤵
PID:18076

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
4⤵
PID:18092

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
4⤵
PID:18108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
4⤵
PID:18124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
4⤵
PID:18140

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
4⤵
PID:18156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
4⤵
PID:18172

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
4⤵
PID:18188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
4⤵
PID:18204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
4⤵
PID:18220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
4⤵
PID:18236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
4⤵
PID:18252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
4⤵
PID:18268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
4⤵
PID:18284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
4⤵
PID:18300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
4⤵
PID:18316

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
4⤵
PID:18332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
4⤵
PID:18348

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
4⤵
PID:18364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
4⤵
PID:18404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
4⤵
PID:18420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
4⤵
PID:17420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
4⤵
PID:17176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
4⤵
PID:17444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
4⤵
PID:17224

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
4⤵
PID:17468

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
4⤵
PID:17484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
4⤵
PID:17304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
4⤵
PID:17508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
4⤵
PID:17352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
4⤵
PID:17384

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
4⤵
PID:17548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
4⤵
PID:17132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
4⤵
PID:17156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
4⤵
PID:17268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
4⤵
PID:17332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
4⤵
PID:10840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
4⤵
PID:18444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
4⤵
PID:18460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
4⤵
PID:18472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
4⤵
PID:18484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
4⤵
PID:18496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
4⤵
PID:18512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
4⤵
PID:18524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
4⤵
PID:18536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
4⤵
PID:18552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
4⤵
PID:18564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
4⤵
PID:18576

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EncryptedLog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:18036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:18780

C:\Windows\System32\SevenCopy.exe
C:\Windows\System32\SevenCopy.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:18832

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
2⤵
PID:17460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:17400

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
2⤵
PID:17964

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:19436

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
2⤵
PID:19204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:18804

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
2⤵
PID:19268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:18708

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
2⤵
- Executes dropped EXE
PID:18412

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
3⤵
PID:17652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:18200

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
3⤵
PID:18752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:18600

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
3⤵
PID:18964

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:18448

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:17648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:18592

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:17644

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
4⤵
PID:17412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:14256

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
4⤵
PID:17268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:14276

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
4⤵
PID:15228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:5468

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
4⤵
PID:19000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:14544

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
4⤵
- Executes dropped EXE
PID:17992

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
5⤵
PID:10228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:4936

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
5⤵
PID:10476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:4516

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
5⤵
PID:11616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:7024

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
5⤵
PID:9584

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:10280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
5⤵
- Executes dropped EXE
PID:10244

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
6⤵
PID:10212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:8716

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
6⤵
PID:9056

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:11128

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
6⤵
PID:7164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:8712

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
6⤵
PID:11144

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:7304

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
PID:6460

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
7⤵
PID:9708

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:10712

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
7⤵
PID:10944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:10892

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
7⤵
PID:14680

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:8408

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
7⤵
PID:13440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:8256

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
7⤵
- Executes dropped EXE
PID:13252

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
8⤵
PID:940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:2636

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
8⤵
PID:10828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:9304

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
8⤵
PID:11312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:10328

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
8⤵
PID:6132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:4248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
8⤵
- Executes dropped EXE
PID:9596

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
9⤵
PID:13560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:12088

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
9⤵
PID:13604

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:10808

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
9⤵
PID:12504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:10160

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
9⤵
PID:10736

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:9096

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
9⤵
- Checks computer location settings
- Executes dropped EXE
PID:2416

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
10⤵
PID:7768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:9020

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
10⤵
PID:6684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:14020

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
10⤵
PID:15020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:10804

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
10⤵
PID:10856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:7968

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
PID:4992

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587701901739865.txt"
11⤵
PID:4520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:14296

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587702178525830.txt"
11⤵
PID:2896

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:14304

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
11⤵
PID:3892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:14016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
11⤵
- Executes dropped EXE
PID:6852

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:14320

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
13⤵
- Executes dropped EXE
PID:13932

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
14⤵
- Executes dropped EXE
PID:11816

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
15⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:11980

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5568

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
17⤵
- Executes dropped EXE
PID:2164

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:11324

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
19⤵
PID:7028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
20⤵
PID:5368

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
19⤵
- Executes dropped EXE
PID:8452

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
20⤵
- Executes dropped EXE
PID:5252

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
21⤵
- Checks computer location settings
- Executes dropped EXE
PID:1284

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
PID:6116

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
23⤵
- Executes dropped EXE
PID:6580

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
24⤵
- Executes dropped EXE
PID:15264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
25⤵
- Executes dropped EXE
PID:9696

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
26⤵
- Executes dropped EXE
PID:5608

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
27⤵
- Executes dropped EXE
PID:10412

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10880

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:8600

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
30⤵
- Executes dropped EXE
PID:7800

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
31⤵
- Executes dropped EXE
PID:7912

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
32⤵
- Executes dropped EXE
PID:2260

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:11936

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
34⤵
- Checks computer location settings
- Executes dropped EXE
PID:13052

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10584

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
36⤵
- Executes dropped EXE
PID:8948

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
37⤵
- Executes dropped EXE
PID:13520

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
38⤵
- Checks computer location settings
- Executes dropped EXE
PID:6492

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
39⤵
- Executes dropped EXE
PID:15252

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
40⤵
- Checks computer location settings
- Executes dropped EXE
PID:6012

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
41⤵
- Executes dropped EXE
PID:11908

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
42⤵
- Executes dropped EXE
PID:15324

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
43⤵
- Executes dropped EXE
PID:11660

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
44⤵
- Executes dropped EXE
PID:11404

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
45⤵
- Executes dropped EXE
PID:5248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15200

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6744

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
48⤵
- Executes dropped EXE
PID:15380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5596

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
50⤵
- Executes dropped EXE
PID:13152

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
51⤵
- Executes dropped EXE
PID:5264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
52⤵
- Executes dropped EXE
PID:9876

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2648

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
54⤵
- Executes dropped EXE
PID:7180

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
55⤵
- Executes dropped EXE
PID:8024

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
56⤵
- Checks computer location settings
- Executes dropped EXE
PID:11360

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:9740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
58⤵
- Executes dropped EXE
PID:16252

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7000

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
60⤵
- Checks computer location settings
- Executes dropped EXE
PID:3732

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
61⤵
- Executes dropped EXE
PID:16380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4976

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
63⤵
PID:13812

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
64⤵
- Checks computer location settings
PID:12224

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
65⤵
- Checks computer location settings
- Drops file in System32 directory
PID:11412

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
66⤵
PID:6636

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
67⤵
PID:15436

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
68⤵
- Drops file in System32 directory
PID:16200

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
69⤵
PID:16688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
70⤵
- Checks computer location settings
PID:16132

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
71⤵
PID:14788

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
72⤵
- Checks computer location settings
PID:10660

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
73⤵
- Drops file in System32 directory
PID:13724

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
74⤵
- Checks computer location settings
- Drops file in System32 directory
PID:5928

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
75⤵
- Drops file in System32 directory
PID:15724

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
76⤵
PID:8924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
77⤵
PID:3048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
78⤵
- Drops file in System32 directory
PID:4928

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
79⤵
PID:16108

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
80⤵
- Checks computer location settings
PID:4164

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
81⤵
- Checks computer location settings
PID:16232

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
82⤵
PID:16660

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
83⤵
- Checks computer location settings
- Drops file in System32 directory
PID:16940

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
84⤵
- Drops file in System32 directory
PID:13528

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
85⤵
PID:12448

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
86⤵
PID:3524

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
87⤵
PID:16820

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
88⤵
PID:9912

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
89⤵
- Checks computer location settings
- Drops file in System32 directory
PID:16160

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
90⤵
PID:9976

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
91⤵
- Drops file in System32 directory
PID:12824

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
92⤵
PID:1556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
93⤵
PID:14512

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
92⤵
PID:16480

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
93⤵
PID:3480

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
94⤵
PID:7372

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
93⤵
- Checks computer location settings
PID:16792

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
94⤵
PID:11208

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
95⤵
PID:16280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
94⤵
- Checks computer location settings
PID:4616

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
95⤵
PID:16960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
96⤵
PID:6524

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
95⤵
- Checks computer location settings
PID:16724

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
96⤵
PID:9040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
97⤵
PID:15740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
96⤵
PID:5588

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
97⤵
PID:8188

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
98⤵
PID:6816

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
97⤵
PID:13600

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
98⤵
PID:7600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
99⤵
PID:10484

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
98⤵
- Checks computer location settings
PID:6236

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
99⤵
PID:14064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
100⤵
PID:7672

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
99⤵
PID:14540

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
100⤵
PID:7532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
101⤵
PID:12684

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
100⤵
- Drops file in System32 directory
PID:10068

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
101⤵
PID:14040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
102⤵
PID:7780

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
101⤵
PID:13904

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
102⤵
PID:11460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
103⤵
PID:12868

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
102⤵
PID:7548

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New Rich Text Document.rtf.lnk"
103⤵
PID:15048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
104⤵
PID:14688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
103⤵
PID:14656

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
104⤵
- Checks computer location settings
- Drops file in System32 directory
PID:11024

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
105⤵
- Drops file in System32 directory
PID:7832

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
106⤵
- Checks computer location settings
PID:12976

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
107⤵
PID:6456

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
108⤵
PID:7956

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
109⤵
PID:5216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
110⤵
PID:13716

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
111⤵
- Drops file in System32 directory
PID:10420

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
112⤵
- Checks computer location settings
PID:15004

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
113⤵
- Checks computer location settings
PID:12364

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
114⤵
PID:9372

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
115⤵
PID:14196

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
116⤵
PID:7208

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
117⤵
- Checks computer location settings
PID:6792

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
118⤵
- Drops file in System32 directory
PID:6136

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
119⤵
PID:13608

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
120⤵
PID:12996

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
121⤵
- Checks computer location settings
- Drops file in System32 directory
PID:14224

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
122⤵
PID:10188

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
123⤵
PID:11740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
124⤵
- Checks computer location settings
PID:1700

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
125⤵
- Checks computer location settings
PID:3400

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
126⤵
PID:12368

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
127⤵
- Checks computer location settings
PID:4584

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
128⤵
PID:5204

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
129⤵
PID:19292

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
130⤵
PID:17608

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
131⤵
PID:17628

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
132⤵
- Checks computer location settings
- Drops file in System32 directory
PID:17792

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
133⤵
PID:18216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
134⤵
PID:19216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
135⤵
PID:19048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
136⤵
- Checks computer location settings
PID:10772

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
137⤵
PID:2532

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
138⤵
- Checks computer location settings
PID:2176

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
139⤵
PID:18224

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
140⤵
- Checks computer location settings
PID:19112

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
141⤵
PID:17856

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
142⤵
- Drops file in System32 directory
PID:18000

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
143⤵
PID:17544

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
144⤵
PID:19132

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
145⤵
- Drops file in System32 directory
PID:18428

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
146⤵
PID:17272

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
147⤵
- Drops file in System32 directory
PID:13980

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
148⤵
PID:10320

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
149⤵
- Drops file in System32 directory
PID:10084

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
150⤵
PID:4640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
151⤵
PID:8544

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
152⤵
PID:6564

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
153⤵
- Checks computer location settings
PID:11972

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
154⤵
PID:7188

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
155⤵
- Checks computer location settings
PID:2416

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
156⤵
PID:10348

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
157⤵
PID:2572

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
156⤵
PID:17976

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
157⤵
PID:18704

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
158⤵
PID:18416

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
157⤵
- Drops file in System32 directory
PID:17880

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
158⤵
PID:18828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
159⤵
PID:5700

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
158⤵
- Drops file in System32 directory
PID:18200

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
159⤵
PID:17528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
160⤵
PID:17580

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
159⤵
- Checks computer location settings
PID:17488

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
160⤵
PID:5696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
161⤵
PID:13448

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
160⤵
PID:12536

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
161⤵
PID:19060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
162⤵
PID:12068

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
161⤵
PID:18924

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
162⤵
PID:8312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
163⤵
PID:11868

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
162⤵
PID:6232

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
163⤵
PID:6216

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
164⤵
PID:5612

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
163⤵
PID:8520

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
164⤵
PID:14088

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
165⤵
PID:12468

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
166⤵
- Checks computer location settings
PID:10212

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
167⤵
PID:11648

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
168⤵
PID:9708

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
169⤵
PID:8368

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
170⤵
- Checks computer location settings
PID:14680

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
171⤵
PID:11704

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
172⤵
- Drops file in System32 directory
PID:4248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
173⤵
PID:11584

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
174⤵
PID:9212

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
175⤵
PID:11148

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
176⤵
- Checks computer location settings
PID:10860

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
177⤵
PID:11540

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
178⤵
PID:14140

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
179⤵
- Checks computer location settings
PID:8388

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
180⤵
- Drops file in System32 directory
PID:7424

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
181⤵
PID:7896

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
182⤵
PID:11240

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
183⤵
- Checks computer location settings
PID:6432

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
184⤵
PID:8420

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
185⤵
- Checks computer location settings
- Drops file in System32 directory
PID:8508

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
186⤵
PID:6264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
187⤵
PID:5444

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
188⤵
PID:8300

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
189⤵
PID:7100

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
190⤵
PID:7800

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
191⤵
- Drops file in System32 directory
PID:400

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
192⤵
- Checks computer location settings
PID:8140

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
193⤵
PID:9716

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
194⤵
- Drops file in System32 directory
PID:8732

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
195⤵
PID:9024

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\New Rich Text Document.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:13028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:18792

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:15184

C:\Windows\System32\SevenCopy.exe
C:\Windows\System32\SevenCopy.exe
1⤵
- Checks computer location settings
PID:10556

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
2⤵
PID:11100

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
3⤵
PID:15192

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
4⤵
PID:15248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
5⤵
PID:7332

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
6⤵
PID:14608

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
7⤵
- Checks computer location settings
PID:5128

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
8⤵
- Checks computer location settings
PID:11656

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
9⤵
- Checks computer location settings
PID:15132

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
10⤵
- Checks computer location settings
PID:5152

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
11⤵
- Checks computer location settings
PID:5704

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
12⤵
PID:6084

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
13⤵
PID:5292

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
14⤵
- Checks computer location settings
PID:8168

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
15⤵
PID:9616

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
16⤵
- Drops file in System32 directory
PID:4980

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
17⤵
- Drops file in System32 directory
PID:12228

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
18⤵
PID:5136

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
19⤵
PID:14032

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
20⤵
PID:15924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
21⤵
- Drops file in System32 directory
PID:8072

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
22⤵
PID:5724

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
23⤵
PID:15420

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
24⤵
- Checks computer location settings
PID:116

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
25⤵
PID:1508

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
26⤵
- Drops file in System32 directory
PID:13832

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
27⤵
PID:4152

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
28⤵
PID:15632

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
29⤵
- Checks computer location settings
- Drops file in System32 directory
PID:10768

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
30⤵
PID:15936

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
31⤵
PID:15840

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
32⤵
- Checks computer location settings
PID:16440

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
33⤵
- Drops file in System32 directory
PID:16596

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
34⤵
PID:13908

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
35⤵
PID:11476

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
36⤵
- Drops file in System32 directory
PID:5628

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
37⤵
- Drops file in System32 directory
PID:11992

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
38⤵
PID:6220

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
39⤵
PID:5796

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
40⤵
- Checks computer location settings
PID:8840

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
41⤵
PID:16576

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
42⤵
- Checks computer location settings
PID:5492

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
43⤵
- Drops file in System32 directory
PID:4948

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
44⤵
PID:15944

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery