Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 21:18
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSeven.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Seven.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SevenCopy.exe -
Deletes itself 1 IoCs
Processes:
SevenCopy.exepid process 4360 SevenCopy.exe -
Executes dropped EXE 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exepid process 4360 SevenCopy.exe 12716 SevenCopy.exe 12228 SevenCopy.exe 12684 SevenCopy.exe 11880 SevenCopy.exe 13068 SevenCopy.exe 13320 SevenCopy.exe 11744 SevenCopy.exe 12092 SevenCopy.exe 11812 SevenCopy.exe 6504 SevenCopy.exe 1612 SevenCopy.exe 8000 SevenCopy.exe 8092 SevenCopy.exe 4452 SevenCopy.exe 11140 SevenCopy.exe 6768 SevenCopy.exe 9544 SevenCopy.exe 7344 SevenCopy.exe 9368 SevenCopy.exe 6252 SevenCopy.exe 9072 SevenCopy.exe 8596 SevenCopy.exe 3564 SevenCopy.exe 7416 SevenCopy.exe 7876 SevenCopy.exe 8764 SevenCopy.exe 8436 SevenCopy.exe 8740 SevenCopy.exe 8588 SevenCopy.exe 8748 SevenCopy.exe 7824 SevenCopy.exe 8220 SevenCopy.exe 7588 SevenCopy.exe 2316 SevenCopy.exe 848 SevenCopy.exe 8816 SevenCopy.exe 9560 SevenCopy.exe 8948 SevenCopy.exe 9408 SevenCopy.exe 8516 SevenCopy.exe 7628 SevenCopy.exe 2516 SevenCopy.exe 8344 SevenCopy.exe 7844 SevenCopy.exe 1552 SevenCopy.exe 10464 SevenCopy.exe 1368 SevenCopy.exe 10772 SevenCopy.exe 10836 SevenCopy.exe 11164 SevenCopy.exe 212 SevenCopy.exe 15104 SevenCopy.exe 6280 SevenCopy.exe 11492 SevenCopy.exe 12424 SevenCopy.exe 7984 SevenCopy.exe 10968 SevenCopy.exe 12400 SevenCopy.exe 11384 SevenCopy.exe 9712 SevenCopy.exe 10976 SevenCopy.exe 10604 SevenCopy.exe 12648 SevenCopy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 10 IoCs
Processes:
SevenCopy.exeSevenCopy.exedescription ioc process File opened for modification C:\Program Files\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Music\desktop.ini SevenCopy.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini SevenCopy.exe File opened for modification C:\Program Files (x86)\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini SevenCopy.exe -
Drops file in System32 directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exeattrib.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exedescription ioc process File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File opened for modification C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File opened for modification C:\Windows\System32\Seven.dll cmd.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File opened for modification C:\Windows\System32\SevenCopy.exe attrib.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File opened for modification C:\Windows\System32\Seven.runtimeconfig.json cmd.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\az_get.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\bun.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\virgo-new-folder.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_history_18.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files\StartPing.exe SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\selector.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview-hover.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up.gif SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\et_get.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\selector.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_checkbox_selected_18.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.jpg SevenCopy.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons2x.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files\MountTrace.ico SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_base.dll SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp SevenCopy.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\ui-strings.js SevenCopy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ui-strings.js SevenCopy.exe -
Drops file in Windows directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2916 powershell.exe 2916 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2916 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2512 wrote to memory of 2916 2512 Seven.exe powershell.exe PID 2512 wrote to memory of 2916 2512 Seven.exe powershell.exe PID 2512 wrote to memory of 3492 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 3492 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 1956 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 1956 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 4672 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 4672 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 3108 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 3108 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 4272 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 4272 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 1904 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 1904 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 2856 2512 Seven.exe cmd.exe PID 2512 wrote to memory of 2856 2512 Seven.exe cmd.exe PID 4672 wrote to memory of 416 4672 cmd.exe attrib.exe PID 4672 wrote to memory of 416 4672 cmd.exe attrib.exe PID 2856 wrote to memory of 4756 2856 cmd.exe attrib.exe PID 2856 wrote to memory of 4756 2856 cmd.exe attrib.exe PID 1904 wrote to memory of 3204 1904 cmd.exe attrib.exe PID 1904 wrote to memory of 3204 1904 cmd.exe attrib.exe PID 2512 wrote to memory of 4360 2512 Seven.exe SevenCopy.exe PID 2512 wrote to memory of 4360 2512 Seven.exe SevenCopy.exe PID 4360 wrote to memory of 4996 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4996 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 2516 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 2516 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 3208 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 3208 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4128 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4128 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4512 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4512 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4880 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4880 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 816 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 816 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 3996 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 3996 4360 SevenCopy.exe cmd.exe PID 3208 wrote to memory of 4980 3208 cmd.exe choice.exe PID 3208 wrote to memory of 4980 3208 cmd.exe choice.exe PID 2516 wrote to memory of 2404 2516 cmd.exe choice.exe PID 2516 wrote to memory of 2404 2516 cmd.exe choice.exe PID 4512 wrote to memory of 3712 4512 cmd.exe choice.exe PID 4512 wrote to memory of 3712 4512 cmd.exe choice.exe PID 4996 wrote to memory of 1612 4996 cmd.exe choice.exe PID 4996 wrote to memory of 1612 4996 cmd.exe choice.exe PID 4128 wrote to memory of 3048 4128 cmd.exe choice.exe PID 4128 wrote to memory of 3048 4128 cmd.exe choice.exe PID 4880 wrote to memory of 2000 4880 cmd.exe choice.exe PID 4880 wrote to memory of 2000 4880 cmd.exe choice.exe PID 4360 wrote to memory of 1440 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 1440 4360 SevenCopy.exe cmd.exe PID 816 wrote to memory of 4532 816 cmd.exe choice.exe PID 816 wrote to memory of 4532 816 cmd.exe choice.exe PID 3996 wrote to memory of 2432 3996 cmd.exe choice.exe PID 3996 wrote to memory of 2432 3996 cmd.exe choice.exe PID 4360 wrote to memory of 3904 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 3904 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4304 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 4304 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 1516 4360 SevenCopy.exe cmd.exe PID 4360 wrote to memory of 1516 4360 SevenCopy.exe cmd.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 416 attrib.exe 3204 attrib.exe 4756 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵PID:3492
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵PID:1956
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\SevenCopy.exe3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:416 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵
- Drops file in System32 directory
PID:3108 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Drops file in System32 directory
PID:4272 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
PID:3204 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\DumpStack.log.tmp"3⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1612
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\libsmartscreen.dll"3⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2404
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4980
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"3⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3712
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"3⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"3⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4532
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"3⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2432
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"3⤵PID:1440
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"3⤵PID:3904
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3636
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"3⤵PID:4304
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"3⤵PID:1516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"3⤵PID:4524
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2572
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"3⤵PID:4316
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2224
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"3⤵PID:3892
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:412
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"3⤵PID:224
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"3⤵PID:4852
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"3⤵PID:1032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ExportExpand.ppt"3⤵PID:2056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6968
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"3⤵PID:2804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6416
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\PopRedo.ppt"3⤵PID:1548
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6920
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ShowResolve.bmp"3⤵PID:2596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"3⤵PID:3108
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6848
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ConfirmUse.ppt"3⤵PID:4804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3468
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"3⤵PID:2688
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"3⤵PID:3412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"3⤵PID:1652
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RegisterAdd.xml"3⤵PID:1836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ResumeRead.ppt"3⤵PID:1704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7976
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"3⤵PID:3388
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8304
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\WriteSubmit.ppt"3⤵PID:4216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7264
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\DismountSync.txt"3⤵PID:5124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8120
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\EnterDisconnect.docx"3⤵PID:5184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3392
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\RedoUndo.lnk"3⤵PID:5204
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1352
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SaveSplit.xlsx"3⤵PID:5256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8548
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"3⤵PID:5272
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7544
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"3⤵PID:5320
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8452
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\OpenOut.pptx"3⤵PID:5360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RedoProtect.lnk"3⤵PID:5376
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ResetRevoke.xlsx"3⤵PID:5396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8800
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\SwitchRename.xml"3⤵PID:5412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8296
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\HideMeasure.png"3⤵PID:5448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8768
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"3⤵PID:5468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RemoveLock.jpg"3⤵PID:5496
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:816
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RepairPing.bmp"3⤵PID:5524
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\WriteDeny.bmp"3⤵PID:5620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9012
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\GrantSplit.lnk"3⤵PID:5636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8788
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\RevokeApprove.jpg"3⤵PID:5668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3576
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SyncShow.xml"3⤵PID:5684
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8384
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1708958184.txt"3⤵PID:5700
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9128
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵PID:5712
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4508
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4733.txt"3⤵PID:5756
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI476E.txt"3⤵PID:5792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4733.txt"3⤵PID:5812
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI476E.txt"3⤵PID:5864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9020
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"3⤵PID:5880
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9520
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240226_142806984.html"3⤵PID:6032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"3⤵PID:6140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9712
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"3⤵PID:3124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"3⤵PID:5144
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10012
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"3⤵PID:5340
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"3⤵PID:5356
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9844
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"3⤵PID:5444
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9548
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"3⤵PID:5492
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9856
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"3⤵PID:5860
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9836
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"3⤵PID:5956
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9680
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"3⤵PID:6148
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml"3⤵PID:6224
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"3⤵PID:6256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9864
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"3⤵PID:6404
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10052
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"3⤵PID:6420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"3⤵PID:6504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"3⤵PID:6656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1132
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"3⤵PID:6712
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10712
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"3⤵PID:6756
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10828
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"3⤵PID:6780
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10264
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"3⤵PID:6796
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10840
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"3⤵PID:6808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵PID:6852
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"3⤵PID:6940
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11220
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"3⤵PID:7080
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"3⤵PID:7124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"3⤵PID:7156
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"3⤵PID:1820
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"3⤵PID:6212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"3⤵PID:6252
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12184
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"3⤵PID:6592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"3⤵PID:4424
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"3⤵PID:4532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"3⤵PID:6872
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"3⤵PID:848
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"3⤵PID:4328
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3976
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"3⤵PID:812
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12388
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"3⤵PID:6128
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"3⤵PID:2328
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11316
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"3⤵PID:6220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12216
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"3⤵PID:3504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"3⤵PID:1124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"3⤵PID:7180
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"3⤵PID:7200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12132
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"3⤵PID:7220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"3⤵PID:7232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"3⤵PID:7248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"3⤵PID:7284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11852
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"3⤵PID:7296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"3⤵PID:7308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"3⤵PID:7352
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"3⤵PID:7444
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"3⤵PID:7460
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12168
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"3⤵PID:7480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"3⤵PID:7548
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"3⤵PID:7572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10484
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"3⤵PID:7616
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"3⤵PID:7632
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12176
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"3⤵PID:7652
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10512
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"3⤵PID:7664
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12316
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"3⤵PID:7676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12284
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"3⤵PID:7736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"3⤵PID:7772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"3⤵PID:7956
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"3⤵PID:8004
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"3⤵PID:8024
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11844
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"3⤵PID:8036
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"3⤵PID:8056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12152
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"3⤵PID:680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11812
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"3⤵PID:4604
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"3⤵PID:3888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"3⤵PID:60
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11788
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"3⤵PID:7376
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"3⤵PID:7392
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12160
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"3⤵PID:7304
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11796
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"3⤵PID:7324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11748
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"3⤵PID:1772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"3⤵PID:4512
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12084
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"3⤵PID:7952
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"3⤵PID:1788
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"3⤵PID:4128
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12068
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"3⤵PID:1864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"3⤵PID:2988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"3⤵PID:4992
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"3⤵PID:8352
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11740
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"3⤵PID:8368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12036
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"3⤵PID:8396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11732
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"3⤵PID:8508
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12052
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"3⤵PID:8664
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11708
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"3⤵PID:8696
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11668
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"3⤵PID:8860
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12016
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"3⤵PID:8872
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"3⤵PID:8884
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12024
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"3⤵PID:8904
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11684
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534304192412982.txt"3⤵PID:9136
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11652
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534304947485472.txt"3⤵PID:9204
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305585063974.txt"3⤵PID:4184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11724
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305838784240.txt"3⤵PID:7244
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12008
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305993432169.txt"3⤵PID:2316
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306202011291.txt"3⤵PID:2516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11676
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306307497107.txt"3⤵PID:2784
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306422958618.txt"3⤵PID:3384
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11660
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306507732240.txt"3⤵PID:8392
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11644
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306555234051.txt"3⤵PID:8856
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11636
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306724923844.txt"3⤵PID:2980
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11716
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306797763586.txt"3⤵PID:8716
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306840988562.txt"3⤵PID:3456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11612
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534307017966781.txt"3⤵PID:9228
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11628
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534308836037735.txt"3⤵PID:9272
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11596
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534309389034619.txt"3⤵PID:9296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534317613489955.txt"3⤵PID:9308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11620
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534317961932866.txt"3⤵PID:9560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534318250199895.txt"3⤵PID:9784
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534318559014940.txt"3⤵PID:9824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11572
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534319484254322.txt"3⤵PID:9900
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11588
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320370810191.txt"3⤵PID:9920
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320433840509.txt"3⤵PID:10152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11604
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320787987604.txt"3⤵PID:10188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11580
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534321887734465.txt"3⤵PID:10216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11912
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534322186603302.txt"3⤵PID:10236
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534322486594540.txt"3⤵PID:1220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534322811216526.txt"3⤵PID:9432
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3508
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534323118972512.txt"3⤵PID:4316
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14852
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534325129811261.txt"3⤵PID:224
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14520
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534352653299232.txt"3⤵PID:10284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14512
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534355772513498.txt"3⤵PID:10296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15344
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534355782745183.txt"3⤵PID:10312
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"3⤵PID:10328
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8656
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"3⤵PID:10344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:10488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1588
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\pkcs11.txt"3⤵PID:10516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8384
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\SiteSecurityServiceState.txt"3⤵PID:10540
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\update100[1].xml"3⤵PID:10564
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14656
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\known_providers_download_v1[1].xml"3⤵PID:10584
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"3⤵PID:10596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9024
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"3⤵PID:10608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10016
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"3⤵PID:10668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"3⤵PID:10680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"3⤵PID:10764
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5156
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"3⤵PID:10800
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15004
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"3⤵PID:10860
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14956
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"3⤵PID:10976
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{20927fb7-c238-4803-bcad-67241bcbe808}\0.0.filtertrie.intermediate.txt"3⤵PID:10988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4320
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{20927fb7-c238-4803-bcad-67241bcbe808}\0.1.filtertrie.intermediate.txt"3⤵PID:11104
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9492
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{20927fb7-c238-4803-bcad-67241bcbe808}\0.2.filtertrie.intermediate.txt"3⤵PID:11120
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1584
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bc4d6969-40c9-41b1-94bf-6ac80063390f}\0.0.filtertrie.intermediate.txt"3⤵PID:11148
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5456
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bc4d6969-40c9-41b1-94bf-6ac80063390f}\0.1.filtertrie.intermediate.txt"3⤵PID:11180
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bc4d6969-40c9-41b1-94bf-6ac80063390f}\0.2.filtertrie.intermediate.txt"3⤵PID:10748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9548
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe1f2851-ffca-4750-ab86-7885527899b0}\0.0.filtertrie.intermediate.txt"3⤵PID:11536
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe1f2851-ffca-4750-ab86-7885527899b0}\0.1.filtertrie.intermediate.txt"3⤵PID:11556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe1f2851-ffca-4750-ab86-7885527899b0}\0.2.filtertrie.intermediate.txt"3⤵PID:11928
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5264
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\appsconversions.txt"3⤵PID:11964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\appsglobals.txt"3⤵PID:11976
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\appssynonyms.txt"3⤵PID:12044
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3392
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\settingsconversions.txt"3⤵PID:12368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5216
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\settingsglobals.txt"3⤵PID:12520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\settingssynonyms.txt"3⤵PID:12532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3820ea15-52b4-4e59-b13e-e1ee641f148c}\0.0.filtertrie.intermediate.txt"3⤵PID:12988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3056
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3820ea15-52b4-4e59-b13e-e1ee641f148c}\0.1.filtertrie.intermediate.txt"3⤵PID:13000
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5220
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3820ea15-52b4-4e59-b13e-e1ee641f148c}\0.2.filtertrie.intermediate.txt"3⤵PID:13292
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5604
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.0.filtertrie.intermediate.txt"3⤵PID:11960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5128
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.1.filtertrie.intermediate.txt"3⤵PID:12360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2596
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.2.filtertrie.intermediate.txt"3⤵PID:12352
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"3⤵PID:4884
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"3⤵PID:6924
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5208
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"3⤵PID:5428
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5584
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"3⤵PID:13492
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"3⤵PID:13632
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10856
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"3⤵PID:13652
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1956
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"3⤵PID:13748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5352
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"3⤵PID:13824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6900
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"3⤵PID:13840
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10888
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"3⤵PID:13852
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"3⤵PID:13864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5972
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"3⤵PID:13920
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"3⤵PID:13940
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"3⤵PID:13960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.73.6_0\128.png"3⤵PID:13976
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5768
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xml"3⤵PID:13988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6544
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\L8PNJOBX\www.bing[1].xml"3⤵PID:14004
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"3⤵PID:14016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"3⤵PID:14032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5184
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"3⤵PID:14048
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"3⤵PID:14068
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"3⤵PID:14088
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5420
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"3⤵PID:14100
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2180
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"3⤵PID:14112
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6188
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"3⤵PID:14132
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5720
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"3⤵PID:14208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6424
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"3⤵PID:14228
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5508
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"3⤵PID:14240
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6084
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"3⤵PID:14260
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5736
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"3⤵PID:14272
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5672
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"3⤵PID:4408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5412
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"3⤵PID:12448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"3⤵PID:7964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5372
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"3⤵PID:13616
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"3⤵PID:13836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5432
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"3⤵PID:7864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"3⤵PID:14188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6640
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"3⤵PID:13908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"3⤵PID:7544
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"3⤵PID:14448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5348
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"3⤵PID:14660
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2724
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"3⤵PID:14672
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6960
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"3⤵PID:14696
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6168
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"3⤵PID:14716
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5880
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"3⤵PID:14732
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6396
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"3⤵PID:14808
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:7992
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6588
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"3⤵PID:14904
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"3⤵PID:14960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5492
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"3⤵PID:14972
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"3⤵PID:15008
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"3⤵PID:15020
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"3⤵PID:15052
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"3⤵PID:15072
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6432
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"3⤵PID:15296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"3⤵PID:15308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6328
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"3⤵PID:15320
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5836
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"3⤵PID:15336
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5908
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"3⤵PID:3600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5956
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"3⤵PID:8636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6372
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:4996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:7088
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
PID:12716 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\DumpStack.log.tmp"2⤵PID:12948
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:11772
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588127748672325.txt"2⤵PID:6808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:12628
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128020149907.txt"2⤵PID:13168
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:11860
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:12228 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:12220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12336
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:12684 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"4⤵PID:11716
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:12104
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:11880 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"5⤵PID:12708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:13592
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:13068 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"6⤵PID:13456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:7896
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:13320 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"7⤵PID:13396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:12244
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:11744 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:12092 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:11812 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"10⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6504 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1612 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:8000 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:8092 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:4452 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:11140 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"16⤵
- Executes dropped EXE
PID:6768 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:9544 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:7344 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:9368 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6252 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"21⤵
- Executes dropped EXE
PID:9072 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:8596 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3564 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"24⤵
- Executes dropped EXE
PID:7416 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
PID:7876 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:8764 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:8436 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:8740 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:8588 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:8748 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:7824 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128326537544.txt"32⤵PID:10164
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 333⤵PID:10368
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"32⤵
- Executes dropped EXE
PID:8220 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128326537544.txt"33⤵PID:3344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 334⤵PID:2328
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:7588 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128326537544.txt"34⤵PID:9784
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 335⤵PID:8544
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2316 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128326537544.txt"35⤵PID:7756
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 336⤵PID:7180
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:848 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128326537544.txt"36⤵PID:4488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 337⤵PID:812
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:8816 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:9560 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:8948 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:9408 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:8516 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:7628 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2516 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:8344 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
PID:7844 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1552 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:10464 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:1368 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:10772 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:10836 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:11164 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
PID:212 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:15104 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6280 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:11492 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:12424 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:7984 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:10968 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:12400 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
PID:11384 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:9712 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:10976 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:10604 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:12648 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"64⤵
- Drops file in Windows directory
PID:11120 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"65⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:11828 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"66⤵
- Checks computer location settings
- Drops file in System32 directory
PID:2112 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"67⤵
- Checks computer location settings
- Drops file in Windows directory
PID:13384 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"68⤵
- Drops file in Windows directory
PID:13720 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"69⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:6736 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"70⤵PID:13668
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"71⤵
- Drops file in System32 directory
PID:14360 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"72⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
PID:4884 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"73⤵
- Checks computer location settings
- Drops file in Windows directory
PID:5964 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"74⤵
- Drops file in System32 directory
PID:14488 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"75⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:13760 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"76⤵
- Checks computer location settings
- Drops file in System32 directory
PID:14252 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"77⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:12984 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"78⤵PID:14068
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"79⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
PID:4756 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"80⤵
- Checks computer location settings
- Drops file in Windows directory
PID:3224 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"81⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:7976 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"82⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5680 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"83⤵
- Drops file in Windows directory
PID:3732 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"84⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:7540 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"85⤵
- Drops file in System32 directory
PID:9040 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"86⤵
- Drops file in System32 directory
PID:13160 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"87⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:14780 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"88⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:6732 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"89⤵
- Checks computer location settings
- Drops file in Windows directory
PID:6632 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"90⤵
- Checks computer location settings
- Drops file in System32 directory
PID:5992 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"91⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
PID:6228 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"92⤵
- Checks computer location settings
- Drops file in Windows directory
PID:6464 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"93⤵
- Checks computer location settings
PID:5756 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"94⤵PID:14976
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
PID:13280 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Checks computer location settings
PID:11980
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\DumpStack.log.tmp.420Filesize
8KB
MD529fe0d1c689519e69f0411aa6a25af94
SHA1171dd5f70e5cbb9dbcecd7c8e8abe8d4c9cdad9d
SHA256beb0b6b96d7992657a944e691d636b6a43101c1967d856f633e3e7d356c529be
SHA5122bdf55dea7c52af011f533ae193dca1bf6c7e944b1a16f95b4ce0fa2b32193999a8a44d5722459b00a336c3c3645701e79e34c301ae934f30d28bea30282113b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.1.filtertrie.intermediate.txt.420Filesize
16B
MD5e8aaa566651759e399714d464cdfb390
SHA1373942a3618c8d5ff0ba8aab8e22d4a64e5641ae
SHA2561a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a
SHA51223f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.2.filtertrie.intermediate.txt.420Filesize
16B
MD5209371fb985ae536f7a01b2cbf06fdeb
SHA16e5d735e5a6aef442f3342931eaf47d505763578
SHA2564cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3
SHA51253203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305993432169.txt.420Filesize
77KB
MD5db44cb2671c7026f63884176766183d1
SHA17851453d3ea5e376b55fd7dbe14cf2cb947e9167
SHA256d2330fe9ab0056f4e3e1d8c6cf9f496e583852eb79de3baae825f077c8d60d5f
SHA512e5ea725104677c0898e70d44e742196c9a8f24418712a3d5ee9f8946798c94e141eb57050deefbacfb4813ef5f3b16256414637290149fa93fa65f6625d253fc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306555234051.txt.420Filesize
64KB
MD511ac6741b0cd7bcd3b9db6d37810ac50
SHA16d18291d18a9ea517b76b75a6d422314d21826d6
SHA2562ee2af334d7553d06d93619d903d2041c6a9853fb59d10a9b03c54825794feab
SHA512e47db917c98276a01fc9cef626cd457e74297ffeb48160cc5072fe760b6f724607c655cea15541d8b3db67126322cb6fbc7c548955bc33f30cc2f087f5414ed3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320433840509.txt.420Filesize
63KB
MD5cb2b816748fd39bd5bfc656a1be9d6a0
SHA162565896f63691f980fec52952e3335ee8b865d1
SHA25609481df47b3c1bf52da64c8e07b30bc0a6aaa75823d734315a31ba88a67a7c57
SHA51255e9ea5f30ba88e6adfc5845b86375999d7e9ed906bde0cf3f35b63b537965a13996d2e5578991fd76149bd32cb1393e46bf732e8943b77328d1482898468298
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534355772513498.txt.420Filesize
74KB
MD5d5ae8b1582ada3900b18296f0d470072
SHA1dc44fb34b4a7c5eecb48a826fb0d6cfc3f53c5a4
SHA25608fcb2d98af7f93f10d275bfb4337de08820f0cdee8debabc176b64546fae992
SHA512d1998e174d58122a79eb4ac1edbb9e74b04adf2f979cc6ee5e85e6a87dfbd20908557932eb352c4487392d89c84e23edf1db8e9df44d66bd032a6106ceabc119
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588128326537544.txt.420Filesize
61KB
MD5cdc3432195b752acceee6114197ce099
SHA188308ddf97c908a8cfabec1dfcb99b79cda3bd14
SHA256a291c9398da75bc878cc310088b5a70a2388dd36b8b5e38bb61cc38c4a791696
SHA512c19626abcd3ff6d6af8190f6418398e87f2d1b017b05e29ea265772977643e1e7cc06819ac5b4e0a88e33a703b674aac6c67b21671b67cc858ff44b873e6904f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0hx2bgw.ouj.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420Filesize
51KB
MD5f14ebdbbc002c8ca15a7b7e139b01b25
SHA1361c8e0f9e1480937b44cb208b65da4cd85d3d52
SHA256c4ac4b34f8ac38a53e2eb6f1b35fefc01cd61c9c325e6ddf5f2d54de518515b8
SHA512a9b2de5fd410db8e58b10fd8b0d854c8c9b191cc4157d38adb07600ee89110665169849d84692a749798db7063de233d837d31f1b0a85b248bad7f32ee4fb269
-
C:\Users\Admin\Desktop\ExportExpand.ppt.420Filesize
170KB
MD5e1f943cdf59b4dff9a7ac29fc3a1bcae
SHA19114c55ffe10926ef95c4cc5f4830c4bb05ba422
SHA2565704134e027eaf03eb9afd089cd04608f5d1b88a318e979cc72adf917dee297c
SHA512a088683070dee5506b14cb91647097a19309eee156bc60c7b40395044ac86288031865c49f6be7f96fff3469750d7c5b82d26f15f3c0ff2347dfa0e3bb62fc2f
-
C:\Users\Admin\Desktop\Microsoft Edge.lnk.420Filesize
2KB
MD5d64e5c56973888ecdfa8de472d45aeb3
SHA18e3f3757f1ca635f547f26c24d61694cf66b5755
SHA2562c141b25dd6b6050009253a3bee82fbaadb461c90d3a68cb4b50436602106377
SHA5126db2227a71bf3506390e8cd0b7f742a6cb3b36f2169d92a7745b0735f8e36019296a291bb4b33c97a309338d2f03a078c30c27cd2acc9470ff907f6286cdf42b
-
C:\Users\Admin\Desktop\PopRedo.ppt.420Filesize
208KB
MD504b2899c19caab2586f46fb43be76862
SHA1116799f7ffe1b1c88a00d7daea0478293da764cf
SHA25651b0bab3c402e9904e0fb63b2b1527157c23257835de17563cebc37e954312bb
SHA512eba4f4f102c053f70cac361e7d4d85bca389f31246c15c91b2a7473a3204e2c6c4709067d389dd2bdc39da3df94df631dbea69a4eb8f1121a3223a038708e1bd
-
C:\Users\Admin\Desktop\ShowResolve.bmp.420Filesize
271KB
MD51faff630c77c9d6afcb42249dd73928f
SHA1942408c8623f5858635b58cb9983b7968af448cb
SHA2567a5103dc282cbee1815d17daf16f601d2e6d23c2d37b9ae3ad40bb15aabc8648
SHA51266131dc6ae8943f33767bb876c4ef0726c74d0423f51d30b6a93000818e3da2d6698cac1ee959c6b6e2c42945633efab526e4bec1a22fe9f063fe14c5e9721fb
-
C:\Users\Admin\Music\SwitchRename.xml.420Filesize
595KB
MD5866e770d328d24f4beb747f61971547c
SHA1df878d950e5c62f749d439d1883e97f6b0893973
SHA256cd1a047447b3a6bbafd9b881993c03f50809b45101a1a5e18141b362e5164f5e
SHA5128a7509cb64e4b45c3665e18f2e31a6f5debf6ec7eba4f3a85ade539f3d718e1a78ddff9c908e58ec7c904aa893e4da50a5954defefdf5d55e0ae4fbc9e42502a
-
C:\Windows\System32\Seven.dllFilesize
1.0MB
MD5c45d00027ae6393b1a717fd1cd2b0bb0
SHA19be0953a450c0949e2ccca35cd84d4acb9be041c
SHA256188a48a4a545fdfc741c85c849fd8044ff70c922c366d1ef0d9c25e497b741cc
SHA5126c91a8f58ce48f17f50c14651c12591fa9464d3ec47f2eb359bb312ed105f0cd81eb89e69f336233d84fb36ccd20ba80a8fba04a18589d6a3972c0854d2ac7f9
-
C:\Windows\System32\Seven.runtimeconfig.jsonFilesize
340B
MD5253333997e82f7d44ea8072dfae6db39
SHA103b9744e89327431a619505a7c72fd497783d884
SHA25628329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
SHA51256d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
-
C:\Windows\System32\SevenCopy.exeFilesize
139KB
MD56503f847c3281ff85b304fc674b62580
SHA1947536e0741c085f37557b7328b067ef97cb1a61
SHA256afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
memory/2916-17-0x00007FF979910000-0x00007FF97A3D1000-memory.dmpFilesize
10.8MB
-
memory/2916-14-0x0000024BE1830000-0x0000024BE1840000-memory.dmpFilesize
64KB
-
memory/2916-11-0x0000024BE1830000-0x0000024BE1840000-memory.dmpFilesize
64KB
-
memory/2916-13-0x0000024BE1830000-0x0000024BE1840000-memory.dmpFilesize
64KB
-
memory/2916-12-0x0000024BE1830000-0x0000024BE1840000-memory.dmpFilesize
64KB
-
memory/2916-10-0x00007FF979910000-0x00007FF97A3D1000-memory.dmpFilesize
10.8MB
-
memory/2916-9-0x0000024BE17C0000-0x0000024BE17E2000-memory.dmpFilesize
136KB