9c31270cbbffbf09ecb94718a16d12cf6710f636453e4e5a0fe07ec70181dbc8

Analysis

max time kernel
65s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

6503f847c3281ff85b304fc674b62580
SHA1

947536e0741c085f37557b7328b067ef97cb1a61
SHA256

afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512

abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
evasion

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 27 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Seven.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Seven.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SevenCopy.exe

Deletes itself 1 IoCs

Processes:

SevenCopy.exe

pid process

4420 SevenCopy.exe

Executes dropped EXE 26 IoCs

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

pid	process
4420	SevenCopy.exe
8280	SevenCopy.exe
7808	SevenCopy.exe
8164	SevenCopy.exe
2816	SevenCopy.exe
11864	SevenCopy.exe
1460	SevenCopy.exe
5644	SevenCopy.exe
7100	SevenCopy.exe
5704	SevenCopy.exe
372	SevenCopy.exe
5888	SevenCopy.exe
17000	SevenCopy.exe
16808	SevenCopy.exe
15740	SevenCopy.exe
15656	SevenCopy.exe
17788	SevenCopy.exe
16836	SevenCopy.exe
17728	SevenCopy.exe
17848	SevenCopy.exe
17336	SevenCopy.exe
17280	SevenCopy.exe
11904	SevenCopy.exe
16868	SevenCopy.exe
9184	SevenCopy.exe
14080	SevenCopy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Seven.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

SevenCopy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe

Drops file in System32 directory 57 IoCs

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeattrib.exeSevenCopy.exeSevenCopy.exeattrib.exeSevenCopy.execmd.exeattrib.exe

description	ioc	process
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\System32\SevenCopy.exe	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File opened for modification	C:\Windows\System32\Seven.dll	cmd.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	attrib.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File opened for modification	C:\Windows\System32\Seven.dll	attrib.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	attrib.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

SearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 22 IoCs

Processes:

SearchApp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

17928 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2144 powershell.exe
2144 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2144 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

SearchApp.exe

pid process

18276 SearchApp.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SearchApp.exe

pid process

18276 SearchApp.exe

pid	process
17928	NOTEPAD.EXE

pid	process
2144	powershell.exe
2144	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2144	powershell.exe

pid	process
18276	SearchApp.exe

pid	process
18276	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3548 wrote to memory of 2144	3548	Seven.exe	powershell.exe
PID 3548 wrote to memory of 2144	3548	Seven.exe	powershell.exe
PID 3548 wrote to memory of 4016	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 4016	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 4804	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 4804	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 1792	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 1792	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 1844	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 1844	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 2208	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 2208	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 2812	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 2812	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 2476	3548	Seven.exe	cmd.exe
PID 3548 wrote to memory of 2476	3548	Seven.exe	cmd.exe
PID 1792 wrote to memory of 5096	1792	cmd.exe	attrib.exe
PID 1792 wrote to memory of 5096	1792	cmd.exe	attrib.exe
PID 2812 wrote to memory of 4340	2812	cmd.exe	attrib.exe
PID 2476 wrote to memory of 3196	2476	cmd.exe	attrib.exe
PID 2476 wrote to memory of 3196	2476	cmd.exe	attrib.exe
PID 2812 wrote to memory of 4340	2812	cmd.exe	attrib.exe
PID 3548 wrote to memory of 4420	3548	Seven.exe	SevenCopy.exe
PID 3548 wrote to memory of 4420	3548	Seven.exe	SevenCopy.exe
PID 4420 wrote to memory of 1840	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 1840	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4412	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4412	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4640	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4640	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 1508	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 1508	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 1296	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 1296	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 3808	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 3808	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 940	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 940	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4424	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4424	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4224	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4224	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 5100	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 5100	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 2028	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 2028	4420	SevenCopy.exe	cmd.exe
PID 1508 wrote to memory of 5116	1508	cmd.exe	choice.exe
PID 1508 wrote to memory of 5116	1508	cmd.exe	choice.exe
PID 4420 wrote to memory of 4816	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4816	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 2308	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 2308	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 5084	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 5084	4420	SevenCopy.exe	cmd.exe
PID 4412 wrote to memory of 1832	4412	cmd.exe	choice.exe
PID 4412 wrote to memory of 1832	4412	cmd.exe	choice.exe
PID 4420 wrote to memory of 4644	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4644	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4476	4420	SevenCopy.exe	cmd.exe
PID 4420 wrote to memory of 4476	4420	SevenCopy.exe	cmd.exe
PID 1840 wrote to memory of 4072	1840	cmd.exe	choice.exe
PID 1840 wrote to memory of 4072	1840	cmd.exe	choice.exe
PID 4640 wrote to memory of 3380	4640	cmd.exe	choice.exe
PID 4640 wrote to memory of 3380	4640	cmd.exe	choice.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

3196 attrib.exe
4340 attrib.exe
5096 attrib.exe

pid	process
3196	attrib.exe
4340	attrib.exe
5096	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
2⤵
PID:4016

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
2⤵
- Drops file in System32 directory
PID:4804

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\SevenCopy.exe
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:5096

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
2⤵
- Drops file in System32 directory
PID:1844

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Drops file in System32 directory
PID:2208

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.dll
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:4340

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.runtimeconfig.json
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:3196

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
3⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
3⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
3⤵
PID:1296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
3⤵
PID:3808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
3⤵
PID:940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
3⤵
PID:4424

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:4224

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:5100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:2028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:4816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:2308

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:5084

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7660

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:4644

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:4476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8612

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\MoveClose.docx"
3⤵
PID:4628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\TestImport.doc"
3⤵
PID:928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\UnblockPing.xml"
3⤵
PID:4780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\UseRename.xls"
3⤵
PID:2012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15224

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
3⤵
PID:4316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CopyShow.ppt"
3⤵
PID:4864

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
3⤵
PID:1460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\InstallCompare.ppt"
3⤵
PID:2520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10004

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
3⤵
PID:3408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
3⤵
PID:4800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
3⤵
PID:2956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ConfirmSet.txt"
3⤵
PID:3920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\EnterClear.xml"
3⤵
PID:3052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\MeasureRestart.html"
3⤵
PID:3612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\PingComplete.xlsx"
3⤵
PID:1484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13828

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\RepairCheckpoint.lnk"
3⤵
PID:4852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\RepairFind.ppt"
3⤵
PID:772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SearchSwitch.docx"
3⤵
PID:548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
3⤵
PID:2468

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14952

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
3⤵
PID:4716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ApproveConnect.xls"
3⤵
PID:3152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ConfirmConvertTo.xml"
3⤵
PID:4076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14812

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ImportGroup.html"
3⤵
PID:856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RevokeProtect.txt"
3⤵
PID:2660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\SkipUse.doc"
3⤵
PID:1404

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\DenyTest.jpg"
3⤵
PID:1552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15640

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\EnterLock.bmp"
3⤵
PID:4340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\MoveSuspend.png"
3⤵
PID:4252

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
3⤵
PID:312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15344

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\PublishEnter.jpg"
3⤵
PID:4016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BlockConvertTo.php"
3⤵
PID:2476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\EnableHide.asp"
3⤵
PID:3384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ExitConvert.txt"
3⤵
PID:2616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnblockRequest.csv"
3⤵
PID:3688

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135627.txt"
3⤵
PID:3856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
3⤵
PID:828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI473A.txt"
3⤵
PID:4100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI475A.txt"
3⤵
PID:2036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI473A.txt"
3⤵
PID:5112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI475A.txt"
3⤵
PID:4240

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
3⤵
PID:1132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124230482.html"
3⤵
PID:4448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
3⤵
PID:4512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
3⤵
PID:1060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"
3⤵
PID:2380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
3⤵
PID:1612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
3⤵
PID:2464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
3⤵
PID:1648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
3⤵
PID:3916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
3⤵
PID:1164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
3⤵
PID:908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
3⤵
PID:2916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
3⤵
PID:2420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
3⤵
PID:5128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
3⤵
PID:5140

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
3⤵
PID:5152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
3⤵
PID:5164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
3⤵
PID:5184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15476

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
3⤵
PID:5200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
3⤵
PID:5224

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
3⤵
PID:5244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
3⤵
PID:5264

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15952

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
3⤵
PID:5288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
3⤵
PID:5304

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
3⤵
PID:5328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5028

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
3⤵
PID:5344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
3⤵
PID:5372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
3⤵
PID:5384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
3⤵
PID:5408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15960

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
3⤵
PID:5420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
3⤵
PID:5440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
3⤵
PID:5460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
3⤵
PID:5472

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15688

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
3⤵
PID:5484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
3⤵
PID:5496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
3⤵
PID:5512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14256

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
3⤵
PID:5540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
3⤵
PID:5580

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
3⤵
PID:5604

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
3⤵
PID:5620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15984

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
3⤵
PID:5640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5060

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
3⤵
PID:5656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16316

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
3⤵
PID:5680

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
3⤵
PID:5704

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
3⤵
PID:5724

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
3⤵
PID:5748

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
3⤵
PID:5768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
3⤵
PID:5788

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
3⤵
PID:5812

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
3⤵
PID:5828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
3⤵
PID:5848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
3⤵
PID:5860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
3⤵
PID:5880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
3⤵
PID:5900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
3⤵
PID:5912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
3⤵
PID:5932

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1712

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
3⤵
PID:5960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
3⤵
PID:5972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
3⤵
PID:5984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15992

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
3⤵
PID:5996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
3⤵
PID:6008

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
3⤵
PID:6028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
3⤵
PID:6040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11812

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
3⤵
PID:6052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16892

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
3⤵
PID:6068

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3100

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
3⤵
PID:6088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
3⤵
PID:6112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
3⤵
PID:6128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
3⤵
PID:4664

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3576

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
3⤵
PID:424

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
3⤵
PID:1072

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay--kglcheck-.lnk"
3⤵
PID:5136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
3⤵
PID:5196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
3⤵
PID:6152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\The Internet.lnk"
3⤵
PID:6164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
3⤵
PID:6184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12248

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
3⤵
PID:6204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
3⤵
PID:6228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
3⤵
PID:6248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
3⤵
PID:6260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
3⤵
PID:6288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
3⤵
PID:6300

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
3⤵
PID:6316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
3⤵
PID:6328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
3⤵
PID:6340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16432

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
3⤵
PID:6352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3048

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
3⤵
PID:6364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
3⤵
PID:6392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
3⤵
PID:6404

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
3⤵
PID:6416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
3⤵
PID:6428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11648

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
3⤵
PID:6440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17216

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
3⤵
PID:6452

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
3⤵
PID:6464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16440

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
3⤵
PID:6484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
3⤵
PID:6496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
3⤵
PID:6508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
3⤵
PID:6520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085280888932.txt"
3⤵
PID:6532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085966055628.txt"
3⤵
PID:6544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16900

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086206312543.txt"
3⤵
PID:6556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086279146572.txt"
3⤵
PID:6568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10812

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086489672153.txt"
3⤵
PID:6588

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14020

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086519342437.txt"
3⤵
PID:6600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086580751035.txt"
3⤵
PID:6624

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086778327262.txt"
3⤵
PID:6656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086798249226.txt"
3⤵
PID:6676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14480

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088054759135.txt"
3⤵
PID:6696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088680666336.txt"
3⤵
PID:6724

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092157337803.txt"
3⤵
PID:6748

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092457469885.txt"
3⤵
PID:6772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092759102724.txt"
3⤵
PID:6796

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093118861419.txt"
3⤵
PID:6816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093532550880.txt"
3⤵
PID:6836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093718685787.txt"
3⤵
PID:6856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095008010161.txt"
3⤵
PID:6876

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14604

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095322670126.txt"
3⤵
PID:6912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095622852471.txt"
3⤵
PID:6932

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14612

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096481601425.txt"
3⤵
PID:6948

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586123970283393.txt"
3⤵
PID:6968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
3⤵
PID:7004

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10860

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
3⤵
PID:7028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:7048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\AlternateServices.txt"
3⤵
PID:7064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14500

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\pkcs11.txt"
3⤵
PID:7080

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\SiteSecurityServiceState.txt"
3⤵
PID:7108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\known_providers_download_v1[1].xml"
3⤵
PID:7128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\update100[1].xml"
3⤵
PID:7152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
3⤵
PID:452

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
3⤵
PID:2272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
3⤵
PID:5736

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
3⤵
PID:1068

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
3⤵
PID:7184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
3⤵
PID:7212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
3⤵
PID:7236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
3⤵
PID:7248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14620

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{33cca336-bc0b-4bf5-81f7-72f383d59d45}\0.0.filtertrie.intermediate.txt"
3⤵
PID:7260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{33cca336-bc0b-4bf5-81f7-72f383d59d45}\0.1.filtertrie.intermediate.txt"
3⤵
PID:7272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{33cca336-bc0b-4bf5-81f7-72f383d59d45}\0.2.filtertrie.intermediate.txt"
3⤵
PID:7284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5b7d796b-42ab-4f4e-88b0-1a31bb688b07}\0.0.filtertrie.intermediate.txt"
3⤵
PID:7308

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5b7d796b-42ab-4f4e-88b0-1a31bb688b07}\0.1.filtertrie.intermediate.txt"
3⤵
PID:7336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15356

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5b7d796b-42ab-4f4e-88b0-1a31bb688b07}\0.2.filtertrie.intermediate.txt"
3⤵
PID:7348

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14736

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bfb8f90f-09b9-4a48-b401-442aea3427d0}\0.0.filtertrie.intermediate.txt"
3⤵
PID:7364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bfb8f90f-09b9-4a48-b401-442aea3427d0}\0.1.filtertrie.intermediate.txt"
3⤵
PID:7380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14728

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bfb8f90f-09b9-4a48-b401-442aea3427d0}\0.2.filtertrie.intermediate.txt"
3⤵
PID:7404

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\appsconversions.txt"
3⤵
PID:7448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\appsglobals.txt"
3⤵
PID:7480

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\appssynonyms.txt"
3⤵
PID:7752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\settingsconversions.txt"
3⤵
PID:7244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\settingsglobals.txt"
3⤵
PID:7200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\settingssynonyms.txt"
3⤵
PID:4632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17004

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{021d2433-3ee9-4590-bdbe-3995198298a8}\0.0.filtertrie.intermediate.txt"
3⤵
PID:7076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{021d2433-3ee9-4590-bdbe-3995198298a8}\0.1.filtertrie.intermediate.txt"
3⤵
PID:6964

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{021d2433-3ee9-4590-bdbe-3995198298a8}\0.2.filtertrie.intermediate.txt"
3⤵
PID:6812

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4348

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.0.filtertrie.intermediate.txt"
3⤵
PID:6620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.1.filtertrie.intermediate.txt"
3⤵
PID:6504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.2.filtertrie.intermediate.txt"
3⤵
PID:6460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15516

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
3⤵
PID:6412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
3⤵
PID:6348

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
3⤵
PID:6312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
3⤵
PID:6224

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
3⤵
PID:6160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
3⤵
PID:7280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
3⤵
PID:6712

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
3⤵
PID:8204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17028

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
3⤵
PID:8232

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
3⤵
PID:8260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4356

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
3⤵
PID:8296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
3⤵
PID:8316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
3⤵
PID:8344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
3⤵
PID:8364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
3⤵
PID:8376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1568

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
3⤵
PID:8388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
3⤵
PID:8404

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
3⤵
PID:8416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5GKYR5FN\www.bing[1].xml"
3⤵
PID:8444

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
3⤵
PID:8460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
3⤵
PID:8472

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
3⤵
PID:8484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
3⤵
PID:8496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
3⤵
PID:8512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
3⤵
PID:8532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
3⤵
PID:8544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
3⤵
PID:8556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
3⤵
PID:8568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
3⤵
PID:8580

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
3⤵
PID:8592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16184

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
3⤵
PID:8624

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
3⤵
PID:8656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16884

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
3⤵
PID:8696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
3⤵
PID:8708

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
3⤵
PID:8720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
3⤵
PID:8732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
3⤵
PID:8744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
3⤵
PID:8756

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
3⤵
PID:8768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
3⤵
PID:8780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
3⤵
PID:8792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
3⤵
PID:8812

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4620

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
3⤵
PID:8844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2456

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
3⤵
PID:8860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
3⤵
PID:8880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16860

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
3⤵
PID:8896

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16828

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
3⤵
PID:8916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16288

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
3⤵
PID:8928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
3⤵
PID:8944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
3⤵
PID:8968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
3⤵
PID:8992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15968

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
3⤵
PID:9012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
3⤵
PID:9032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15660

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
3⤵
PID:9048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
3⤵
PID:9064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
3⤵
PID:9084

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
3⤵
PID:9108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
3⤵
PID:9128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
3⤵
PID:9148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
3⤵
PID:9164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15976

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
3⤵
PID:9184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
3⤵
PID:9200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
3⤵
PID:9240

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
3⤵
PID:9268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
3⤵
PID:9288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
3⤵
PID:9312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17020

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
3⤵
PID:9332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
3⤵
PID:9352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
3⤵
PID:9368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17208

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
3⤵
PID:9388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16812

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:8280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
4⤵
PID:17900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
4⤵
PID:17928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
4⤵
PID:17944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
4⤵
PID:17964

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18388

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
4⤵
PID:17980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
4⤵
PID:17996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
4⤵
PID:18012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
4⤵
PID:18180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
4⤵
PID:18200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BlockConvertTo.php"
4⤵
PID:18216

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EncryptedLog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:17928

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:18276

C:\Windows\System32\SevenCopy.exe
C:\Windows\System32\SevenCopy.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:7808

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
2⤵
PID:7792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:11648

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
2⤵
PID:11824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:10756

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
2⤵
PID:11944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:10724

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
2⤵
PID:9864

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:7128

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
2⤵
PID:15280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:3684

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
2⤵
PID:10164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:2188

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:8164

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
3⤵
PID:11772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7856

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
3⤵
PID:8064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6416

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
3⤵
PID:15248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10100

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
3⤵
PID:6592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:60

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:6512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6936

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
3⤵
PID:6420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7880

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:2816

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
4⤵
PID:9248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:14620

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
4⤵
PID:6660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:3612

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
4⤵
PID:6772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:6272

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
4⤵
PID:7952

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:4912

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
4⤵
PID:7272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:9396

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
4⤵
PID:10516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:7112

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:11864

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
5⤵
PID:5316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:7312

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
5⤵
PID:8032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:10112

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
5⤵
PID:12532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:8252

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
5⤵
PID:396

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:6472

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
5⤵
PID:1956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:7396

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
5⤵
PID:4108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:3788

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:1460

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
6⤵
PID:9736

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:8244

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
6⤵
PID:9232

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:16036

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
6⤵
PID:10884

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:16240

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
6⤵
PID:8892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:6348

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
6⤵
PID:12624

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:15332

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
6⤵
PID:16052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:6968

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5644

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
7⤵
PID:4344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:828

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
7⤵
PID:15268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:8788

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
7⤵
PID:2824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:5548

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
7⤵
PID:16600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:5116

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
7⤵
PID:13088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:15524

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
7⤵
PID:9436

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:6848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:7100

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
8⤵
PID:15420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:12968

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
8⤵
PID:632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:5928

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
8⤵
PID:17172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:5592

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
8⤵
PID:13892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:6212

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
8⤵
PID:8568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:15720

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
8⤵
PID:11324

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:4896

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5704

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
9⤵
PID:15516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16236

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
9⤵
PID:6028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16308

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
9⤵
PID:14096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16180

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
9⤵
PID:14200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16020

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
9⤵
PID:5532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16208

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
9⤵
PID:15632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:5048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:372

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
10⤵
PID:4612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:17332

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
10⤵
PID:12956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:6748

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
10⤵
PID:13936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:17136

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
10⤵
PID:2400

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:7900

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
10⤵
PID:9568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:17024

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
10⤵
PID:2456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:17428

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5888

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
11⤵
PID:15732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:17596

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
11⤵
PID:17164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:17664

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
11⤵
PID:15680

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:16684

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
11⤵
PID:15596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:5080

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
11⤵
PID:17548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:17532

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
11⤵
PID:16456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:4844

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:17000

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
12⤵
PID:16356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:15592

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
12⤵
PID:15996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:1916

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
12⤵
PID:16920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:16492

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
12⤵
PID:16668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:17312

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
12⤵
PID:17364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:16632

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
12⤵
PID:1268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:16664

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:16808

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
13⤵
PID:1296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:16740

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt"
13⤵
PID:16592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:17652

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt"
13⤵
PID:1656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:16700

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt"
13⤵
PID:6800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:16960

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
13⤵
PID:17072

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:17844

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"
13⤵
PID:16584

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:16640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:15740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:15656

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
15⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:17788

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:16836

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:17728

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:17848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:17336

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:17280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:11904

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:16868

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:9184

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:14080

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
25⤵
PID:9124

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
26⤵
PID:13524

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
27⤵
PID:14400

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
28⤵
PID:14204

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
29⤵
PID:3748

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
30⤵
PID:5104

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
31⤵
PID:5188

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
32⤵
PID:6248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
33⤵
PID:10672

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
34⤵
PID:2396

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
35⤵
PID:8884

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
36⤵
PID:11044

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
37⤵
PID:10460

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
38⤵
PID:7960

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
39⤵
PID:12312

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
40⤵
PID:6356

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
41⤵
PID:12444

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
42⤵
PID:9648

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
43⤵
PID:5476

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
44⤵
PID:13612

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
45⤵
PID:7184

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
46⤵
PID:11552

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
47⤵
PID:5468

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
48⤵
PID:5492

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
49⤵
PID:14108

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
50⤵
PID:10180

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
51⤵
PID:8216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
52⤵
PID:9472

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
53⤵
PID:6852

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
54⤵
PID:13244

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
55⤵
PID:13584

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
56⤵
PID:9532

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
57⤵
PID:1804

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
58⤵
PID:5752

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
59⤵
PID:11184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml
Filesize
97B

MD5
e9384418c1a473f1634f253ef08586a4

SHA1
f7d891bfd972e2640e075420b6775f558ead2e64

SHA256
cc56e6451fd8075ad750fdfc144741a4a69a25b850aa33218742fead2803c894

SHA512
164320ab0f209dbce590d9e0316e3542e5b4eca062e4e5b9c9c2f0360d5a3ef40d45c89fdeefad021f2bc5b0ba5471bae3a42d205e24a16ca07a9faff10ac167

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml.420
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml.420
Filesize
112B

MD5
c106d7cf039d9bdf8e6647e2241b78e3

SHA1
181578b7422c56e1d103c0a13ca15440434cd641

SHA256
ae7fda6967ed7ba0f984d39508869fd752da64a971bc31516d224d56d2194da2

SHA512
f7a4f629db1e3561124f40412407e5dab3bd2de4e45a26d4ffd569d2f35573bd2ee0346944c54eb3f36e3b97f87a54583072d1924f32b17466e3c6a4b598a480

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.1.filtertrie.intermediate.txt.420
Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.2.filtertrie.intermediate.txt.420
Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086489672153.txt.420
Filesize
77KB

MD5
dd56b5f0a861b48dfce9d275bf9087b5

SHA1
17a164cc7fa4488e4a975f85b405ecf9c45e4a29

SHA256
9813caceff5a80f3eaa65fb89f291f49cd1cac4f7e32f49bedec232facf53eae

SHA512
8c5b86ecdfda4d98f8b1b9c69657cd07fd5c87531ae313bb3c7f16fb47097205040e57241a46185aadb61e695266c4cdef959644302da1787ca5c7be12c8fb0f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088680666336.txt.420
Filesize
47KB

MD5
007cdeeef4694b382d2a181c27773629

SHA1
74087753dd3baf84c932cdd46a55d25c629d13cc

SHA256
b4fe3e4b415ed5d9b4c345a4c80801ce47b2ea32eba257a6f0634554637f96ef

SHA512
f9865ed1bbff04a4b3c0a63b3803a54c82d81182c6abc0bbc9823a1b464a72525fa091fe7f4f211d1ada2f1f6c4eb6f63461295cf59d7b10337b0b46b88f878b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095008010161.txt.420
Filesize
66KB

MD5
49decfe81666667c457426ab0aaef75f

SHA1
acc34ab1529ea7dd693f03363c142bdef769a7cd

SHA256
a43dba137e9a0e50daf794f7b2969acd3dd4232f05736aa7112ef57b86216de4

SHA512
bd0dd2daf63f9deddca74b6ee2f36c54efe05f920a33af26b14609850e87f9743169c6f7f5552bd38a3bc5257a29b5fe16950bba31ec1f62d56c5fff3ec5b302

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095598710616.txt
Filesize
75KB

MD5
de608c66a9c00599c5b8a5762d6105b5

SHA1
4c755cd22e0e60cbb8db4a4ec6d90d1ee97377f7

SHA256
f47c6e213aa786b80735da5ed1b7054acb54acd1dc47519d9d016684ee32f828

SHA512
f4afbf8e4a3504496339db9eef1f68e333c30eee494470a57d6da10e39bd1c949a7d73f4b1be31d146263b91a022c88efe1fb5d2ce1bd7144ad481744392919f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095622396289.txt.420
Filesize
75KB

MD5
f8faa75d7a848e39303afc9e47e9da4e

SHA1
a66076c629cc4d8db3e925c67a87001419c02a5f

SHA256
0eb8f342d3eb80423374442d702ba83befb760ccac007bdf7d856cf06d88349a

SHA512
c01fa810fe8ec3fcd42c934998255c31b7a5fa1f42e38779c4552282e8005a48afe690322b2cc2281cfda8b5714e7dceda134eeffd77ba1f1c3d5b30dc534d6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt
Filesize
62KB

MD5
15209da79165ea9b0534bb371289158d

SHA1
c2ff24398b64898edc9574e3328ea939a5650778

SHA256
70a14f82b31a448ad366cc3331e19879886a45db44851a7256ce9ff44d653134

SHA512
89e67dc559d0bdddce3cec827b902412bc196848e4b26c22483c11d65b14a0f3dcf8682228b65762f8e44bb580e563b166ec0cf0d5eaf33e8fbe6f11f57f2768

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588095633215843.txt.420
Filesize
63KB

MD5
bb3c6ecfc15e18deb722a53b9764dade

SHA1
524d6f8f58807ec4d1803de5831d782e6eb14144

SHA256
4c5031244859e870b69c65bca3074fa50d613669471fcf4e780b6c84d4200c5d

SHA512
9517857fa79e908500cb18376163f0257630f48022983a6ba2423b7fe596d1ed68ee12a59f131f925f4ecf3da4331b49b49fabce58cf99db67e768ac70699c5c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
Filesize
188KB

MD5
25ce5d1b1e892a442cdfbcbaf72b9c22

SHA1
133768a050527d2c24c9ec2b9b5241b28ba45afb

SHA256
0e7e3e52bf0c854840d9734c6a24e4fd64abcf5f0a2a3fce5d016b9d10bf428b

SHA512
68f3f4fd32be88886b06346e3ff68342a67376ac0c333d36bee01022e669222a5f77961937d0a95c8269f8032eaaea7c05ca7dbdc36794dafb4d472dcebec5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v5lgdi5i.pzn.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\BlockConvertTo.php.420
Filesize
441KB

MD5
a666860bb58f9d4d045d74edf77db785

SHA1
339e8a7efdd2207a0518e76558ddd435b2df1075

SHA256
e6077e5bdead2f85ab6fd9ada786dc62003ab3c732e4c8c674278b6a0740190a

SHA512
744f237c50927ef0f075cdf891bf7fd2b69040c489daef1fd2853d2c6d62345d811ee60091f62a0fff1be2dd494993d44bfe74c03486797bea2ae91e7d0520f2

Download Submit
C:\Users\Admin\AppData\Roaming\EnableHide.asp.420
Filesize
549KB

MD5
8c16bf6590d9f0e5c1fd4f44b76525be

SHA1
1f4e8bd3e03eebd602ce27fc4c198f369cf56255

SHA256
ff05b2729b6d503d369f5b21d31049fa5647bb30d0402cb82b02807752b0b542

SHA512
b0729e247cb93f5071064d2d298ec415a8bb0587089d14163aa0a415557fb613edc87081277454418e1011f015ba9524d69478a2390ed2dd6a7a1715056a2da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk.420
Filesize
592B

MD5
69201be6cfea04842d86fbf826099b54

SHA1
ac9ea5390850cb7676562c69feca82d71e17b0ef

SHA256
ff4e35652f4800e2a4f28f7cbf829b1ed427bdaa6f42727d11ec04ddd05c74db

SHA512
0108aedca34bf3d4e4d20d5c4a362cfb1d6a029c39545c69d8757e6e1d885bddcbd8def25f3b8b971cf7791d646e82555a406749fcddb2360878c58e8bd467ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420
Filesize
51KB

MD5
4927e0cb561d4450afc0b847853f42f2

SHA1
4a3645773d95ed07b59272871f2e88c399adf0dc

SHA256
8ed353d134b8d10b78f61ed8bfc614aacaff504a1d0659be1d245ca97c759384

SHA512
5ec501ba8e731ab4ca7df72887850bd560e65151d03a32be9839948df2f12d38ab921bf3a30fd73e41262925aa1b43ad1b8b9b3eb6e500f82c1985cfb34145c0

Download Submit
C:\Users\Admin\Desktop\EncryptedLog.txt
Filesize
114B

MD5
529e18d451b40fb328381713434c5ffc

SHA1
db0400fadc91b9eff06dca8ec741693cb018d76d

SHA256
bd126e7853f8e55cfe7e07e1aa17d434893b0ac0bc9231c4306989d093fe836b

SHA512
8e9e811a1e237bb0ec5730e8104db429b24a01841fe58a84b2583c0500218fdd977ee934288814993af6ce141225c115be31cb0ed96a155b4605a05544f6f2db

Download Submit
C:\Users\Admin\Links\Desktop.lnk.420
Filesize
512B

MD5
92aa50871d73ecc8107781504a042f76

SHA1
68d154dfaa6786d24037223bb2614653cd49acaa

SHA256
a3e1cf594513a2eb12f4867607adf6e83561d1323a99e662e7eecff1c36dcab6

SHA512
fcba8005a307f17b04a64d443e68be540c7c9df75493f87c06a0c27be178547053b1103f3bb3e713bf6a4afaf0502bf556d2acefb3ba3344f26afed95b593457

Download Submit
C:\Users\Admin\Links\Downloads.lnk.420
Filesize
944B

MD5
04b6404caa47d1eeeda529d3c771f22a

SHA1
ff41e0336655700d9368e0dbbac5422b2f561658

SHA256
41ee8928e130c1e7178a629c8fd9bb5d60a797b54f5891170654e238181eab23

SHA512
2409342b0128b1496a1bf3fc1e60dff85818fe533ce78fc8f7c641c45dee8721815aeec567a33df41fd56aaf91d20dd985a42ecfc347bda566ed421efe8a5da8

Download Submit
C:\Windows\System32\Seven.dll
Filesize
1.0MB

MD5
41083841b32af239b1a18efe4a4fe025

SHA1
c9aead48e4fb96533d8cb575d273a189d3d130cd

SHA256
3bacc01749f901310009812087cbc2b2f2d4fd2707a4e6078230e880b10e5fab

SHA512
b4f2837d6c71429b91bc67cb6b5c886be20db7054377746a983502c662477ed061133915a70f81b4f8c78c63c2141bef78b491ea2382701f966cf0ae96960f28

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json
Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
C:\Windows\System32\SevenCopy.exe
Filesize
139KB

MD5
6503f847c3281ff85b304fc674b62580

SHA1
947536e0741c085f37557b7328b067ef97cb1a61

SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.420
Filesize
195KB

MD5
e555c4d99008c0bd1d4efd9ad532cc85

SHA1
b66789e351dff3c10110962c72fc71ef43fb2191

SHA256
4b343df3ffc95a0998f95c193a806eaca9a07c47a82e34f559dd528431f6729c

SHA512
89c2863cc25237368844b5a949b4759fa4d487022ffa8e5552072fa72cf8568230c33013a9242c897af5916e94553ad0ae0ccd4ddc3b933b41515ad558658719

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.420
Filesize
191KB

MD5
4d07ca959bb1a4ed4885f4bb11d690a9

SHA1
6a6edcfbd04a721097c837a294f70ab77cd3d2af

SHA256
1ff85bd6bd9e000dbc3440be972d9f939178c181aeb677b75ccb1afc017f6322

SHA512
ac17254b1614392840bb5136d91c7878ffd131cc3b1196e3add38e01207cdb11caa77dfeb9b145eed1b140a89aeefd84580d3bdacb51760550b0d5442108fcfb

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.420
Filesize
198KB

MD5
3bd92be0c9f6461a2d8f992791f457ae

SHA1
8acfbaf922bb77fc253633209420e0a18532415c

SHA256
b72847dc66906444e8c1ee9c466d0222f5a4290ae67cc1cc2d3f8ac537b87ce7

SHA512
2719ad151c2af2d76dc4bab5982b780453a8a9f07075b8153f80e32d3279b3edceb29b1e68e62e22ea594497cb7bbd6f32ae709d12c50558af822d3e03087768

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.420
Filesize
123KB

MD5
76d6986b94b46fd7ce69926dc28c4d17

SHA1
b4e236b707f0927e1a612c72c31ee7ad60a382c9

SHA256
6580509a049e1d0b712503314d24cab1083d167ee04bf71792ed91fba5e47fde

SHA512
619de40e20b0b70e4249e6b08e76589cdb14cc34cc522a204e98824fa9d57a4c203c5f6bf9dbd34f8c2e59642ff74f6e9af2924154b91b80575b9242062deac4

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.420
Filesize
129KB

MD5
c5e8ec7d38662b27e2ad0186a254dd56

SHA1
f12260a41f7ddaa54c9ff2eb24b6f2a4c6243929

SHA256
1016308592f438c3a67a75cb5930f2c6f0e6fdcf6b816de102144e935ccb4382

SHA512
17f2aa56437795eddb98b5246c17014ea504322f56aa00ab9e68ae60fe834915598918be8255a66aaedde151526b3e3d20be20ce535417b98fc456dd7f514680

Download Submit
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.420
Filesize
123KB

MD5
6e58404e58135433be2709d88de84a7a

SHA1
5d702427a1b37c9dcde87096cf87b7fa4ac00a96

SHA256
2e5d79a46c53c694b89ee4a9f24e25d8654f5bc0a56da4adaf593d940ea15eb0

SHA512
4cf0c938ca07bdc687ca1974c369b00c5d7544f7acfe9d152aa7b33e762e8c9cc7ede0e7904bf250314a652a8c3908bdd2b929075246527755c0b241aaa8f849

Download Submit
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.420
Filesize
135KB

MD5
635671fac4225a41696c9aa0f91067d4

SHA1
5aa9181d84333bcd767f730e6cf2f4a8799364e0

SHA256
27d0e36d26b7703f858c636ef3f9c42ecbf594c4d4882cd256119113befecea3

SHA512
c8f1c0e2f5bedb096dd74df5fc74f00c313b465e923cc49b11a8b6331dc8079fa0f02bfe095dd808210d3621576ff59b950879678856b34ecb39528449bc0389

Download Submit
memory/2144-9-0x000001F2EDF70000-0x000001F2EDF92000-memory.dmp

Filesize
136KB

Download
memory/2144-15-0x00007FF957D90000-0x00007FF958851000-memory.dmp

Filesize
10.8MB

Download
memory/2144-10-0x00007FF957D90000-0x00007FF958851000-memory.dmp

Filesize
10.8MB

Download
memory/2144-11-0x000001F2EDEF0000-0x000001F2EDF00000-memory.dmp

Filesize
64KB

Download
memory/2144-12-0x000001F2EDEF0000-0x000001F2EDF00000-memory.dmp

Filesize
64KB

Download
memory/18216-405-0x00007FF7BF520000-0x00007FF7BF587000-memory.dmp

Filesize
412KB

Download
memory/18276-426-0x00000235E4C40000-0x00000235E4C60000-memory.dmp

Filesize
128KB

Download
memory/18276-414-0x00000235E4C80000-0x00000235E4CA0000-memory.dmp

Filesize
128KB

Download
memory/18276-430-0x00000235E4FD0000-0x00000235E4FF0000-memory.dmp

Filesize
128KB

Download
memory/18276-410-0x0000022DE2300000-0x0000022DE2400000-memory.dmp

Filesize
1024KB

Download