65e2102fcff7b912144aa217886a37a6b0f69c4c79be5c5ac286ea75d60f624e

Analysis

max time kernel
75s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

6503f847c3281ff85b304fc674b62580
SHA1

947536e0741c085f37557b7328b067ef97cb1a61
SHA256

afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512

abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Seven.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Winhost.exe

Executes dropped EXE 13 IoCs

pid	Process
2160	Winhost.exe
10896	Winhost.exe
18156	Winhost.exe
3788	Winhost.exe
3504	Winhost.exe
13612	Winhost.exe
3252	Winhost.exe
12136	Winhost.exe
6492	Winhost.exe
6584	Winhost.exe
14800	Winhost.exe
15220	Winhost.exe
7060	Winhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Winhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\System32\Winhost.exe	cmd.exe
File opened for modification	C:\Windows\System32\Winhost.exe	attrib.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\Seven.dll	attrib.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File opened for modification	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File opened for modification	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File created	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File opened for modification	C:\Windows\System32\Winhost.exe	cmd.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	attrib.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbfdwsz.tmp"	Seven.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
15336	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	powershell.exe
1916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1916	2360	Seven.exe	88
PID 2360 wrote to memory of 1916	2360	Seven.exe	88
PID 2360 wrote to memory of 1244	2360	Seven.exe	90
PID 2360 wrote to memory of 1244	2360	Seven.exe	90
PID 2360 wrote to memory of 4680	2360	Seven.exe	91
PID 2360 wrote to memory of 4680	2360	Seven.exe	91
PID 2360 wrote to memory of 4928	2360	Seven.exe	92
PID 2360 wrote to memory of 4928	2360	Seven.exe	92
PID 2360 wrote to memory of 2860	2360	Seven.exe	93
PID 2360 wrote to memory of 2860	2360	Seven.exe	93
PID 2360 wrote to memory of 4072	2360	Seven.exe	94
PID 2360 wrote to memory of 4072	2360	Seven.exe	94
PID 2360 wrote to memory of 5108	2360	Seven.exe	95
PID 2360 wrote to memory of 5108	2360	Seven.exe	95
PID 2360 wrote to memory of 3188	2360	Seven.exe	96
PID 2360 wrote to memory of 3188	2360	Seven.exe	96
PID 4928 wrote to memory of 4844	4928	cmd.exe	97
PID 4928 wrote to memory of 4844	4928	cmd.exe	97
PID 3188 wrote to memory of 4216	3188	cmd.exe	98
PID 3188 wrote to memory of 4216	3188	cmd.exe	98
PID 5108 wrote to memory of 2288	5108	cmd.exe	99
PID 5108 wrote to memory of 2288	5108	cmd.exe	99
PID 2360 wrote to memory of 2160	2360	Seven.exe	104
PID 2360 wrote to memory of 2160	2360	Seven.exe	104
PID 2160 wrote to memory of 5344	2160	Winhost.exe	107
PID 2160 wrote to memory of 5344	2160	Winhost.exe	107
PID 2160 wrote to memory of 1380	2160	Winhost.exe	814
PID 2160 wrote to memory of 1380	2160	Winhost.exe	814
PID 2160 wrote to memory of 2596	2160	Winhost.exe	110
PID 2160 wrote to memory of 2596	2160	Winhost.exe	110
PID 2160 wrote to memory of 2520	2160	Winhost.exe	112
PID 2160 wrote to memory of 2520	2160	Winhost.exe	112
PID 2160 wrote to memory of 3172	2160	Winhost.exe	114
PID 2160 wrote to memory of 3172	2160	Winhost.exe	114
PID 2160 wrote to memory of 1004	2160	Winhost.exe	116
PID 2160 wrote to memory of 1004	2160	Winhost.exe	116
PID 2160 wrote to memory of 4544	2160	Winhost.exe	117
PID 2160 wrote to memory of 4544	2160	Winhost.exe	117
PID 2160 wrote to memory of 5760	2160	Winhost.exe	118
PID 2160 wrote to memory of 5760	2160	Winhost.exe	118
PID 2160 wrote to memory of 2108	2160	Winhost.exe	119
PID 2160 wrote to memory of 2108	2160	Winhost.exe	119
PID 2160 wrote to memory of 6024	2160	Winhost.exe	121
PID 2160 wrote to memory of 6024	2160	Winhost.exe	121
PID 2160 wrote to memory of 6100	2160	Winhost.exe	125
PID 2160 wrote to memory of 6100	2160	Winhost.exe	125
PID 2160 wrote to memory of 4968	2160	Winhost.exe	126
PID 2160 wrote to memory of 4968	2160	Winhost.exe	126
PID 2160 wrote to memory of 216	2160	Winhost.exe	127
PID 2160 wrote to memory of 216	2160	Winhost.exe	127
PID 2160 wrote to memory of 696	2160	Winhost.exe	128
PID 2160 wrote to memory of 696	2160	Winhost.exe	128
PID 2160 wrote to memory of 5424	2160	Winhost.exe	131
PID 2160 wrote to memory of 5424	2160	Winhost.exe	131
PID 2160 wrote to memory of 2844	2160	Winhost.exe	133
PID 2160 wrote to memory of 2844	2160	Winhost.exe	133
PID 1380 wrote to memory of 1116	1380	cmd.exe	702
PID 1380 wrote to memory of 1116	1380	cmd.exe	702
PID 5344 wrote to memory of 5224	5344	cmd.exe	140
PID 5344 wrote to memory of 5224	5344	cmd.exe	140
PID 2596 wrote to memory of 5624	2596	cmd.exe	706
PID 2596 wrote to memory of 5624	2596	cmd.exe	706
PID 3172 wrote to memory of 5096	3172	cmd.exe	142
PID 3172 wrote to memory of 5096	3172	cmd.exe	142

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4844	attrib.exe
4216	attrib.exe
2288	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\Winhost.exe
  2⤵
  PID:1244
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\Winhost.exe
  2⤵
  - Drops file in System32 directory
  PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Winhost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Winhost.exe
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4844
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
  2⤵
  - Drops file in System32 directory
  PID:2860
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
  2⤵
  - Drops file in System32 directory
  PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Seven.dll
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:2288
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Seven.runtimeconfig.json
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4216
- C:\Users\Admin\AppData\Local\Temp\Winhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
    3⤵
    PID:2520
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1456
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
    3⤵
    PID:1004
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
    3⤵
    PID:4544
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
    3⤵
    PID:5760
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5308
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
    3⤵
    PID:2108
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
    3⤵
    PID:6024
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
    3⤵
    PID:6100
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
    3⤵
    PID:4968
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
    3⤵
    PID:216
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4892
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
    3⤵
    PID:696
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
    3⤵
    PID:5424
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
    3⤵
    PID:2844
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\DismountRestart.jpg"
    3⤵
    PID:228
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
    3⤵
    PID:244
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13164
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\MountConvertFrom.docx"
    3⤵
    PID:3320
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\OpenComplete.bmp"
    3⤵
    PID:4888
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\AddMount.pptx"
    3⤵
    PID:5652
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
    3⤵
    PID:3280
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
    3⤵
    PID:5608
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13672
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\FindDeny.txt"
    3⤵
    PID:5280
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14028
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ImportDisable.doc"
    3⤵
    PID:8
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2356
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\InstallUse.csv"
    3⤵
    PID:2748
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14012
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\InvokePush.csv"
    3⤵
    PID:1096
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\LimitConfirm.pptx"
    3⤵
    PID:4232
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14020
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
    3⤵
    PID:5064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2984
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
    3⤵
    PID:4512
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SelectUnregister.pptx"
    3⤵
    PID:4896
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ShowInstall.pdf"
    3⤵
    PID:5168
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
    3⤵
    PID:3928
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnpublishJoin.doc"
    3⤵
    PID:5352
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\WatchUnregister.html"
    3⤵
    PID:3152
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SubmitCompress.png"
    3⤵
    PID:3252
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SubmitGet.xlsx"
    3⤵
    PID:4012
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4016
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UpdateSelect.pdf"
    3⤵
    PID:4400
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14360
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
    3⤵
    PID:5204
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
    3⤵
    PID:4444
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2696
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\UnpublishReset.xml"
    3⤵
    PID:5076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
    3⤵
    PID:5088
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\NewGroup.png"
    3⤵
    PID:5228
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14420
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\DenySet.xml"
    3⤵
    PID:5152
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14392
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\GrantReset.xml"
    3⤵
    PID:860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510733.txt"
    3⤵
    PID:3216
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2728
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
    3⤵
    PID:2976
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI23F5.txt"
    3⤵
    PID:4844
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2413.txt"
    3⤵
    PID:4664
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI23F5.txt"
    3⤵
    PID:4696
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2413.txt"
    3⤵
    PID:456
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
    3⤵
    PID:1868
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
    3⤵
    PID:2948
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070740298.html"
    3⤵
    PID:4680
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
    3⤵
    PID:3188
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14524
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
    3⤵
    PID:3780
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14692
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
    3⤵
    PID:3212
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
    3⤵
    PID:2400
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
    3⤵
    PID:636
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
    3⤵
    PID:2916
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
    3⤵
    PID:1560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
    3⤵
    PID:2052
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
    3⤵
    PID:5884
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
    3⤵
    PID:1628
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
    3⤵
    PID:4004
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
    3⤵
    PID:4556
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
    3⤵
    PID:3356
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
    3⤵
    PID:5436
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
    3⤵
    PID:2620
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
    3⤵
    PID:1432
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
    3⤵
    PID:1708
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14860
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
    3⤵
    PID:1052
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
    3⤵
    PID:996
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2228
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
    3⤵
    PID:4772
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14836
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
    3⤵
    PID:6156
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
    3⤵
    PID:6172
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14844
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
    3⤵
    PID:6396
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
    3⤵
    PID:6412
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
    3⤵
    PID:6592
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
    3⤵
    PID:6608
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
    3⤵
    PID:6624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14368
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
    3⤵
    PID:6640
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
    3⤵
    PID:6652
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
    3⤵
    PID:6676
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15032
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
    3⤵
    PID:6692
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
    3⤵
    PID:6704
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
    3⤵
    PID:6720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5692
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
    3⤵
    PID:6948
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15344
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
    3⤵
    PID:7020
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
    3⤵
    PID:7040
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14984
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
    3⤵
    PID:7052
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
    3⤵
    PID:7064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
    3⤵
    PID:7076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
    3⤵
    PID:7088
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14976
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
    3⤵
    PID:7100
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5528
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
    3⤵
    PID:7112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15768
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
    3⤵
    PID:5020
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
    3⤵
    PID:3712
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
    3⤵
    PID:5392
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
    3⤵
    PID:6312
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
    3⤵
    PID:6336
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16284
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
    3⤵
    PID:6344
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14820
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
    3⤵
    PID:6368
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16308
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
    3⤵
    PID:6688
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
    3⤵
    PID:6620
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
    3⤵
    PID:6672
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
    3⤵
    PID:7032
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
    3⤵
    PID:7216
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
    3⤵
    PID:7228
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14992
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
    3⤵
    PID:7240
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
    3⤵
    PID:7264
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
    3⤵
    PID:7276
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15936
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
    3⤵
    PID:7288
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15232
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
    3⤵
    PID:7320
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
    3⤵
    PID:7344
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
    3⤵
    PID:7356
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15256
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
    3⤵
    PID:7400
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
    3⤵
    PID:7416
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14608
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
    3⤵
    PID:7436
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
    3⤵
    PID:7464
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
    3⤵
    PID:7484
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16748
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
    3⤵
    PID:7500
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
    3⤵
    PID:7512
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15264
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
    3⤵
    PID:7524
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
    3⤵
    PID:7536
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
    3⤵
    PID:7548
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
    3⤵
    PID:7564
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
    3⤵
    PID:7576
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5920
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
    3⤵
    PID:7588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
    3⤵
    PID:7604
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
    3⤵
    PID:7616
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
    3⤵
    PID:7628
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
    3⤵
    PID:7640
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15140
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
    3⤵
    PID:7656
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
    3⤵
    PID:7668
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15248
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
    3⤵
    PID:7680
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
    3⤵
    PID:7696
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
    3⤵
    PID:7708
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
    3⤵
    PID:7720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
    3⤵
    PID:7732
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14740
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
    3⤵
    PID:7748
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
    3⤵
    PID:7760
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15412
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
    3⤵
    PID:7772
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
    3⤵
    PID:7784
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16060
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
    3⤵
    PID:7800
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15420
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
    3⤵
    PID:7812
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
    3⤵
    PID:7824
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836418013652.txt"
    3⤵
    PID:7836
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15272
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837096414018.txt"
    3⤵
    PID:7852
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837443444937.txt"
    3⤵
    PID:7864
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837640277591.txt"
    3⤵
    PID:7876
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837687940046.txt"
    3⤵
    PID:7892
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5032
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837744362386.txt"
    3⤵
    PID:7904
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837939951274.txt"
    3⤵
    PID:7916
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837978777915.txt"
    3⤵
    PID:7932
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15692
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839074637091.txt"
    3⤵
    PID:7944
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839712016426.txt"
    3⤵
    PID:7956
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579843207563210.txt"
    3⤵
    PID:7976
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16740
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579843507466942.txt"
    3⤵
    PID:7988
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579843808534166.txt"
    3⤵
    PID:8000
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844217534408.txt"
    3⤵
    PID:8012
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844630253682.txt"
    3⤵
    PID:8028
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844816569293.txt"
    3⤵
    PID:8048
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846092837203.txt"
    3⤵
    PID:8064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846392471437.txt"
    3⤵
    PID:8076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846692840690.txt"
    3⤵
    PID:8088
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846992823764.txt"
    3⤵
    PID:8100
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847755903877.txt"
    3⤵
    PID:8116
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579865020725898.txt"
    3⤵
    PID:8128
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579867951712963.txt"
    3⤵
    PID:8140
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
    3⤵
    PID:8180
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
    3⤵
    PID:6972
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
    3⤵
    PID:1328
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\pkcs11.txt"
    3⤵
    PID:8408
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15336
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VDZ45OC0\known_providers_download_v1[1].xml"
    3⤵
    PID:8424
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15156
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VDZ45OC0\update100[1].xml"
    3⤵
    PID:8436
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16608
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
    3⤵
    PID:8452
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
    3⤵
    PID:8464
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
    3⤵
    PID:8480
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15288
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
    3⤵
    PID:8492
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15280
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
    3⤵
    PID:8504
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15216
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
    3⤵
    PID:8516
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15200
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
    3⤵
    PID:8528
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
    3⤵
    PID:8540
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5696
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7208d451-1b96-4a3e-9a98-c7e7544bbcc2}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:8552
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3688
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7208d451-1b96-4a3e-9a98-c7e7544bbcc2}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:8564
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7208d451-1b96-4a3e-9a98-c7e7544bbcc2}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:8576
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{748a716d-c5ed-4d2a-8a4f-1cf3228d4b0c}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:8588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{748a716d-c5ed-4d2a-8a4f-1cf3228d4b0c}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:8600
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{748a716d-c5ed-4d2a-8a4f-1cf3228d4b0c}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:8612
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a7c18a06-53c4-43bc-b3e3-53d107e5e8f1}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:8624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a7c18a06-53c4-43bc-b3e3-53d107e5e8f1}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:8636
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a7c18a06-53c4-43bc-b3e3-53d107e5e8f1}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:8648
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\appsconversions.txt"
    3⤵
    PID:8660
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\appsglobals.txt"
    3⤵
    PID:8680
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15928
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\appssynonyms.txt"
    3⤵
    PID:8692
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\settingsconversions.txt"
    3⤵
    PID:8720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\settingsglobals.txt"
    3⤵
    PID:8732
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\settingssynonyms.txt"
    3⤵
    PID:8744
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f2498ad6-a1ee-4cab-90a9-b26879fa10d1}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:8756
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f2498ad6-a1ee-4cab-90a9-b26879fa10d1}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:8768
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f2498ad6-a1ee-4cab-90a9-b26879fa10d1}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:8780
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f5f563ab-8370-4daa-939e-05085f5b46bb}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:8792
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1264
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f5f563ab-8370-4daa-939e-05085f5b46bb}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:8804
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f5f563ab-8370-4daa-939e-05085f5b46bb}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:8824
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16600
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
    3⤵
    PID:8848
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15920
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
    3⤵
    PID:8860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
    3⤵
    PID:8872
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
    3⤵
    PID:8884
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
    3⤵
    PID:8896
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
    3⤵
    PID:8908
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
    3⤵
    PID:8920
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
    3⤵
    PID:8936
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16012
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
    3⤵
    PID:8948
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15472
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
    3⤵
    PID:8960
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
    3⤵
    PID:8972
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
    3⤵
    PID:8984
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5200
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
    3⤵
    PID:8996
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
    3⤵
    PID:9008
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15512
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
    3⤵
    PID:9032
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15600
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
    3⤵
    PID:9044
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
    3⤵
    PID:9056
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2292
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
    3⤵
    PID:9068
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6YMWEKY3\microsoft.windows[1].xml"
    3⤵
    PID:9080
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\NS3KXMQF\www.bing[1].xml"
    3⤵
    PID:9092
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16260
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
    3⤵
    PID:9104
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
    3⤵
    PID:9124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
    3⤵
    PID:9136
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
    3⤵
    PID:9148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
    3⤵
    PID:9172
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
    3⤵
    PID:9192
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15572
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
    3⤵
    PID:9208
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
    3⤵
    PID:7148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16124
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
    3⤵
    PID:7848
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
    3⤵
    PID:4044
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
    3⤵
    PID:1340
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15656
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
    3⤵
    PID:7140
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
    3⤵
    PID:7412
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
    3⤵
    PID:9840
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
    3⤵
    PID:9856
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
    3⤵
    PID:9904
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16276
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
    3⤵
    PID:9924
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
    3⤵
    PID:9936
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
    3⤵
    PID:9948
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
    3⤵
    PID:9968
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
    3⤵
    PID:9984
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16292
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
    3⤵
    PID:10000
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
    3⤵
    PID:10020
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
    3⤵
    PID:10036
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
    3⤵
    PID:10052
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
    3⤵
    PID:10068
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16180
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
    3⤵
    PID:10088
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
    3⤵
    PID:10104
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
    3⤵
    PID:10124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
    3⤵
    PID:10136
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
    3⤵
    PID:10176
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
    3⤵
    PID:10216
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
    3⤵
    PID:7480
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15708
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
    3⤵
    PID:7624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
    3⤵
    PID:8296
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
    3⤵
    PID:10444
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15648
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
    3⤵
    PID:10472
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15848
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
    3⤵
    PID:10484
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
    3⤵
    PID:10504
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
    3⤵
    PID:10520
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
    3⤵
    PID:10532
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
    3⤵
    PID:10544
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
    3⤵
    PID:10560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15792
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
    3⤵
    PID:10592
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
    3⤵
    PID:10604
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15824
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
    3⤵
    PID:10620
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16172
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
    3⤵
    PID:10636
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
    3⤵
    PID:10648
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
    3⤵
    PID:10660
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
    3⤵
    PID:10676
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Winhost.exe
    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:10896
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
      4⤵
      PID:17524
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
      4⤵
      PID:17540
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\DenySet.xml"
      4⤵
      PID:17584
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18408
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\GrantReset.xml"
      4⤵
      PID:17600
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510733.txt"
      4⤵
      PID:17616
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
      4⤵
      PID:17632
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI23F5.txt"
      4⤵
      PID:17656
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2413.txt"
      4⤵
      PID:17736
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18084
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI23F5.txt"
      4⤵
      PID:17760
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18328
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2413.txt"
      4⤵
      PID:17776
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:17952
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
      4⤵
      PID:17796
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
      4⤵
      PID:17812
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070740298.html"
      4⤵
      PID:17860
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
      4⤵
      PID:17956
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
      4⤵
      PID:17972
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18364
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
      4⤵
      PID:17988
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
      4⤵
      PID:18004
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
      4⤵
      PID:18056
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1412
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
      4⤵
      PID:18080
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
      4⤵
      PID:18096
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
      4⤵
      PID:18160
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
      4⤵
      PID:18176
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
      4⤵
      PID:18192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
      4⤵
      PID:18292
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
      4⤵
      PID:18320
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
      4⤵
      PID:18336
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
      4⤵
      PID:18352
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
      4⤵
      PID:18368
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
      4⤵
      PID:18388
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
      4⤵
      PID:18404
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
      4⤵
      PID:18424
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
      4⤵
      PID:2356
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
      4⤵
      PID:5292
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
      4⤵
      PID:4320
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
      4⤵
      PID:17476
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
      4⤵
      PID:17680
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
      4⤵
      PID:17608
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
      4⤵
      PID:17840
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
      4⤵
      PID:17804
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
      4⤵
      PID:17856
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
      4⤵
      PID:17940
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
      4⤵
      PID:17996
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
      4⤵
      PID:17968
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:17648
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
      4⤵
      PID:17964

C:\Windows\System32\Winhost.exe
C:\Windows\System32\Winhost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:18156
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588659102808412.txt"
  2⤵
  PID:14016
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14728
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588659382340530.txt"
  2⤵
  PID:17860
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14724
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
  2⤵
  PID:17820
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4232
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.0.filtertrie.intermediate.txt"
  2⤵
  PID:5252
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:17816
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.1.filtertrie.intermediate.txt"
  2⤵
  PID:5864
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14864
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.2.filtertrie.intermediate.txt"
  2⤵
  PID:5544
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.0.filtertrie.intermediate.txt"
  2⤵
  PID:17640
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14856
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.1.filtertrie.intermediate.txt"
  2⤵
  PID:14188
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4120
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.2.filtertrie.intermediate.txt"
  2⤵
  PID:14004
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14960
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\appsconversions.txt"
  2⤵
  PID:3468
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14900
- C:\Windows\System32\Winhost.exe
  "C:\Windows\System32\Winhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3788
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588659102808412.txt"
    3⤵
    PID:624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14416
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588659382340530.txt"
    3⤵
    PID:17528
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17592
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
    3⤵
    PID:14412
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6440
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:5244
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3272
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:17560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6872
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:14472
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10388
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:1856
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6768
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:1144
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2824
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:14556
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2944
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\appsconversions.txt"
    3⤵
    PID:17784
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6668
- - C:\Windows\System32\Winhost.exe
    "C:\Windows\System32\Winhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3504
  - - C:\Windows\System32\Winhost.exe
      "C:\Windows\System32\Winhost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      PID:13612
    - - C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3252
      - C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:12136
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        7⤵
        
        PID:4488
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:2068
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        8⤵
        
        PID:4308
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        9⤵
        
        PID:2460
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        9⤵
        
        PID:14772
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        10⤵
        
        PID:6032
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:14800
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:15220
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        11⤵
        Executes dropped EXE
        
        PID:7060
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        12⤵
        
        PID:6264
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        13⤵
        
        PID:14668
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        14⤵
        
        PID:3156
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        15⤵
        
        PID:6700
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        16⤵
        
        PID:12712
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        17⤵
        
        PID:6228
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        18⤵
        
        PID:14824
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        19⤵
        
        PID:16728
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
        20⤵
        
        PID:14820
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        21⤵
        
        PID:8732
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        20⤵
        
        PID:2312
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
        21⤵
        
        PID:15696
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        22⤵
        
        PID:10684
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        21⤵
        
        PID:11256
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
        22⤵
        
        PID:8120
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        23⤵
        
        PID:11520
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        22⤵
        
        PID:12860
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        23⤵
        
        PID:11160
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        24⤵
        
        PID:9964
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        25⤵
        
        PID:14904
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
        26⤵
        
        PID:5704
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        27⤵
        
        PID:15544
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        26⤵
        
        PID:9400
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
        27⤵
        
        PID:16020
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        28⤵
        
        PID:12864
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        27⤵
        
        PID:15740
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        28⤵
        
        PID:12556
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        29⤵
        
        PID:8528
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        30⤵
        
        PID:6640
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        31⤵
        
        PID:6812
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        32⤵
        
        PID:16316
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        33⤵
        
        PID:8864
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        34⤵
        
        PID:8872
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        33⤵
        
        PID:13536
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        34⤵
        
        PID:15652
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        35⤵
        
        PID:11204
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        34⤵
        
        PID:15908
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        35⤵
        
        PID:16360
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        36⤵
        
        PID:15312
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        35⤵
        
        PID:4736
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        36⤵
        
        PID:17264
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        37⤵
        
        PID:17024
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        36⤵
        
        PID:15232
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        37⤵
        
        PID:12988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EncryptedLog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:15336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420

Filesize
16B

MD5
b59488bb8ce8a90e59483f98cda8cd73

SHA1
2200b17eafb3c19792c138db93d2d3b517a4fb2c

SHA256
08e46f314c68a256cbb1dc8968b76e637f5a29a2c69ad377fde5d8b63bbf3174

SHA512
e3e1a9a732cf4d751c86de3b04281684ecf900079d3cfe3c2c67c873504812b77662dc62a219ce10c6297b4c3b1bb354a3808fb37b8c5b7082aa3065493851d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.420

Filesize
2KB

MD5
79c6d2f86802a292f41fa3c385f61fae

SHA1
c64a66a9a2f645bcb309ea9d10813f557a05294f

SHA256
5910fcb4482dd12e202860f1fc72fa144aa27b390fa275901092f9214398fe9d

SHA512
cbe4311403e3bdc10e33ca0ff2d8a380346769a01a9cddfce292eb5da3ef506a47570f301868acc7bf4e52b1a483dc984b9f35bdfbaea976f3da388e099bc6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420

Filesize
6KB

MD5
aef715c2174210b8e238c91b03940492

SHA1
cec87417cd3f203304b3840ebe9b7121c78e8f61

SHA256
9c3e1ea98f01c2348588951a3dc29108e57237861443939a98439f19c2f3c6c6

SHA512
fbf68e73bb94a7152e9c34b19f5d0656c57da639033829d6fe0c52113bffc36f4d5352bbff9278ffaf0031445429a5ca623e7f19364a87aa78769b21d985d326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.420

Filesize
321KB

MD5
585002fd4d920042c3df96a55b15265e

SHA1
8a3460d110c788735ee5318452be9d66e26cf803

SHA256
012a9ca399cafc89ce6de583f6759e283aaa6ace0ba18b879a70e67c71cd28d1

SHA512
5fdf32a7e064818cc8d3ce3dc3f12c11766630f76d58f93e7b0f44e093175cc2e584d34f05b85ac13747a1db297fe1e4de59333caa8daefd1900abfc43842d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml.420

Filesize
560B

MD5
ce7a2191490b33f6635bf3172acee6d8

SHA1
f02feff3160bca6d14b7169de2cb713c2310630b

SHA256
b9166a5fb3af0a1ca977221e0cd131e4c33a6bfb7e48bdde79822e9d69592784

SHA512
c801dacde4163bdf7ed6c21eb13e5acf2a7ce71b3f6f5a003e58f8580f2651b7adc543a3e680da9183262a1cb87bb796762b8ae86a1c8637cddd1f937f5231ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml.420

Filesize
100KB

MD5
6df18ce09245971e338740f870084394

SHA1
a40043b2edff084d0524361d9854440eec48dede

SHA256
c5da6142ec5f836293652b73c9bf8fd91847c35f16cb5956e188ec6a7b1c0315

SHA512
f345482afaf6130cef932814a0dd957fb0c7ddf88190f634c911c4eb909a9f8032cf834ae898875a5f7a61df7a5669602cf1a426145e6a1902433477d86eeec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.420

Filesize
130KB

MD5
971626d372e843e06a467e87531980b7

SHA1
afc29ec325c6cffe180db538f1ea37f084b5cc07

SHA256
4869597258a3ae224079a5ff5d841113e544af2403c4911e9c1776d811ba149c

SHA512
796f07f0e93ce9deebe926f6d24f843cf572a0fcf14e156629768d612cb01964fac9cd258e992894556c8bef13c63f0f19de88aa8ccdd6896b45045c66459413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.420

Filesize
270KB

MD5
85146fe4b4856a1b57a6172c66bbd2c9

SHA1
6c9bffc717198baad4466b6ac7faf1588de5118e

SHA256
8666046bf445502116e8b34da531e987589159616ddd727fc4623c8f3f0f2fea

SHA512
42561081193f7720810936336fd3dddd1e08e2ca6ae39751f124a8798282eb7972f42acffac320d5d6adec84b747de2ce86117b7117e9675d2338acd2f5667ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.420

Filesize
333KB

MD5
b2d58c31fa5c5e0610a191cd225ddf8c

SHA1
162d4827ae036ed28d1a32ea1432717278a043fb

SHA256
eca3a52060f14ed8976fd20828d69c0acdd26f7e575d8f5152fdd371329f35ea

SHA512
7382ff2ea0df08e7d65ee254f688c4b2e084f2ac664731f53c0afe2f30e1f1ddcafcc7feda0521cc9d43abf8aaf7164e52bf13782cf5281928398e8d82b9323b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.420

Filesize
5KB

MD5
7ddfa22afa17b213b92a2d706cedb7d4

SHA1
3ce6e66634953a4676609f17dd7c917288151cb7

SHA256
568c811db6c7f33dce5723a3e73934cf7639f6fbffa43f2699ecc471953d083a

SHA512
119b92a454857cedb6707217f2f59d886ba075b5585616343c86708bf78a6e299a34b7d1a66471feaddeb970197be5a0a0cc273044762c69eae1331b1acf5860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.420

Filesize
7KB

MD5
af406b2f60e1bdc11f38941d4c8ee789

SHA1
c2a5e8544d6d052f31d4be12b56bcc79c7075228

SHA256
f2f3321fae628993beeb9510f3413887be214dd23d438c59ee4fc04ce5577e19

SHA512
06d53eb7a72a654613e6d6c950664fe6dee076f14fa5bf454bceb658e5c02c00f183d82374587e9c3bddac9a7c224db047fbccd51551a29e18feef59e753c492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.420

Filesize
8KB

MD5
20212b619de20ca8036bcfa143b448a5

SHA1
257258f87b8b35b6269a59f62832d91e978dcda8

SHA256
56567fdd908eb6c58aecf155741eca281ab127131056baba63c25b5882160180

SHA512
e427ae838380b97dd33d4bdd507bacac8788aabd095223d5f73b4ccd341d10aca6eb9b9b1da51adb78666cfe3746e5847e71103464bbc9b55c802777f14593da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.420

Filesize
2KB

MD5
117b11840457bb459a7de042aeaf905c

SHA1
e8ea99d0a748a512e3a6d8b8a3954ec2dfb9f549

SHA256
c82ceb7025d365cb99c623060b4676c4b8c61393818ff5cf48ae51dc5dee4dd5

SHA512
20a3d7c86d4d5388c4a6a2d91067b3d7484e5506422747e77237ad31f53f8af407919f12468975402a9fba1d91e0c2f03f316a2b2224d87e56e87facfb022165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.420

Filesize
10KB

MD5
3bc42eb1eccdfafa617b61474724dac2

SHA1
6a26940a2e23be374d418ec2ec606b50f84bb0a5

SHA256
88cd551ed0c80aea22a7cc6bfb3bf7dcb9f49abc7b7bff007f7532157f1298c1

SHA512
08a12861bb2320022298b5f1707f245671ce8a46766b4700f47a66d6bbeab79285d156ecd6fb32058ebecaf5b8a52691f4a6801177bfc3867f865130e5a2d678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.420

Filesize
7KB

MD5
79aa301d332168d9ecfba9705dc6f18f

SHA1
f47eb9382e85cf252f7ba4fcaa983e71d9031097

SHA256
90662bf8645df521077b9de4fbb61b355791f2b7638d0250b6b0b21c3b5d418b

SHA512
2819fdb2dd5851bb19455176ef6016ae44789552632cda589ad07c89d54f1c8b91f00f0c060ba83b64946b8973463441eb60f82835d2f4b95ac22a5d2dfc6e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.420

Filesize
4KB

MD5
3dff36784bd6d115206129782508df22

SHA1
b84b2cd5fa681000cfe543e09e0cd1af0e0e2645

SHA256
2a43eb1ff6700e2111e4737de83ea2af08c9bd2369dbd3253cfd6c2b7d0db60b

SHA512
5c5e2378920f60f91f5f512c04ef63f5b056c03a90be965bcd5c293d7f9b39c9d292ff9f8e037f8aef98d3ceaa7d8bf5545d23713fd24076c2eecf2823ea76df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.420

Filesize
7KB

MD5
6482ceacd5de556c906e9174ea213ac4

SHA1
9656e3a8e1315f109c3f4cc4d7df5427919ed736

SHA256
8d789177af9a428e3e035d4b574983aa577d227f341b12800d0a4dfebc20c84a

SHA512
8c7dd9b2fd53b38b20f38a1cd79d1c7d63c93f6d50fa12b81856cced8ddba7b840e50dc44a927d56f7553e5b6436d352abfedf5b885328ab65af8992781d8d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html.420

Filesize
6KB

MD5
a3a2e4e16aaaa6cca6e15f9c90eb7dfe

SHA1
54e9f7ad2b8e11526c7006dffe24cb2376d546ba

SHA256
5ba1dbcb7f628236eb28138e59539ab100dcb9c6c8dc58970780edc8deee4e6e

SHA512
830788686f299d92dddb14c23b5fe3161d438362a7a235ef74ae3fb6cf6043bf39ecc91cbd4f28c605198b8982326ba38f975f525b4375ed146c8acc642e1b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.420

Filesize
14KB

MD5
c7a6875d4b6bd830b490da8514d4ac8c

SHA1
5cf2cb12dd45468f56c07fdda90066982bb21a41

SHA256
5d0cb829307b1ac8ed6ce598bfdc25a10bcf31fa253d78ff65576472e21c7aa8

SHA512
245b0a07e81f2bab9ea6dad29629059e54d83940dbf90b1caec564733c29230380e25e87f06f48da04ff653236fa46dc168bb6bc65a96e8b20663e432f5f84a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.420

Filesize
10KB

MD5
ae81ade97d2022bc559f821233eaf251

SHA1
4d2db669aed5219ebd52b0275dfcbee823364006

SHA256
51ef1bccb57ec7f93b6e4e6aaca6234b3d2e1fa7c88af2e3b24b7635bf73ff3b

SHA512
a662848e8eb903f3183c4e6c8d72f7200c6cdbd284c7427652d7ea786de624d330e542ecc0965d9988a1e0dd32756208119ecd3d709ddb6be4f75f1b5451f561

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.420

Filesize
10KB

MD5
f5d45c66151be312d7930f8dd76d263c

SHA1
39607f30eab1acb130a6f3bc33826dadc791a3d2

SHA256
886066767cd98f0571bf04e7028232c05e670ba855de71fa9f29c5d217a96bd8

SHA512
719ed3b7fcea5153beb0c7b310b39f249a2b6e043e24bc501435478f5e5fff37b65d0787aad72de377fcfd6ee7f783154ea53da48e513b6d7add850c83d4c492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html.420

Filesize
6KB

MD5
c3588d56a93318f10a1f793601c624dc

SHA1
c86a79454eec483d8af919daa89f11650ca89535

SHA256
80483d2a355989aa4caad3b74ea89a8e7a85af2e693c11ebf968bab3637dd668

SHA512
48079d6cae5d6128fb1ed2531d1df0dabe08fb758edf6091be2d1c745c105062924b15ed23e024d52be0f44bf64d86defc6ca6aca67588749262382a23c94fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.420

Filesize
4KB

MD5
2137052f3a4740453eef134d833fe515

SHA1
899afc8803980257f87f68fce70526f44e4681cf

SHA256
b9f30902704f6f64d5f9677182f9021a43e57a03bf72729bcb4d7b4e59f902d2

SHA512
8f39d8c36087f04695360cc7321ed275ef2df6dfa5d5d139551e0096dd4659058165db778d936cfe81e2ee6cf42d672efadf664d0840617c7cc11c42c493463f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.420

Filesize
8KB

MD5
5ac6e918f45de88df57be721161ea6b0

SHA1
99a9798c124b034be5c62013d6b0ca141d1d3562

SHA256
76a0f92020287fd0c32485b054fd08ab0bf8248f3fe3ec7b50455b22ab67ea05

SHA512
932321e9768b216971ec621a2fa884351cca2baef5226e0b5747d0709b851ed09ba3f2d33306a1cd2deb9f4ce4b33227f36bc16468668b7c71b632a974a44c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.420

Filesize
47KB

MD5
2bbffea67fd3664e3428d14f1b21ae9f

SHA1
0c324e5ff82f8a1e5b3e70597f71c263cbb07b6c

SHA256
89e64f11995f8f665bc064c907d33fb86cba32653ba256ed847a51bf89a91c30

SHA512
45eb9dce53dc40117dd5c38aeb1c8e4ad3bde1f7a1bac5e2e38e708cdbb09576ead26cdd807b21bb820b9a5df11901a3e615cf76946c03a0cf16ef3b734a7346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.420

Filesize
720B

MD5
7292c68b20c58e9c78acb05ca8c9d56e

SHA1
e01722906f89a7a3a728c8c385ac9d306bc485ad

SHA256
14cf318ff227a7a73e5441eb91cd513fe134714b58a8b1863495f3abe4ab2f71

SHA512
95c0da6794cee8c658d1f9bed5b303e2b4f861c979b598f69876bd57ddc2e31fd03996ceed01253783bf5f4d8c9fbe303514844633c14f2286f083781099b425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420

Filesize
352B

MD5
83930b510ce271650edd8d5e457fd006

SHA1
9b4a2f832b345311ecd0cc5aa073f4992db964b8

SHA256
ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3

SHA512
b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7c283fc0-5c4e-45a9-a59b-0dc11c42ee01}\0.0.filtertrie.intermediate.txt.420

Filesize
28KB

MD5
4d4cba128b55392ff16ac4d714eb061b

SHA1
0435a26a1627cc57338c613e2937eb96cd1cc6a0

SHA256
2b911c21a0ae0d5e87c6acde84bbf9eae05d652fb91aede87be7f30526f87216

SHA512
317b30bc1fea6edae7776e54fac3c8ab1d457bc0d07690e33ef54302b5bf812dc00d98377e303b21997f55d6bc78fc42864321ae0470daff634ebeec86481f30

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d1814b79-67af-4b37-9708-7111976876e8}\0.0.filtertrie.intermediate.txt.420

Filesize
3KB

MD5
a73f181b5e4ee78643821d6950260f68

SHA1
238cb72a2873f64637836e783083fbee29218d59

SHA256
a36be3a9bb62c9a9ec40f40ba72dc8f01c8d5eb25a22d79bcf08bd9760e9cbd0

SHA512
f1ef58e2c877d48954a49b3605707821d9575c102d28876ed8f2f70de864c41313b2a8d6fa51cf24fff3790848e3ff395fedcf608cada378b22bfc057d341bb1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9efe58e1-dae2-4eb2-87e3-f5b486730137}\appsconversions.txt.420

Filesize
1.4MB

MD5
9faee69c2364e2675cb65f98b92b6fea

SHA1
25caeff143682d4104c99256a63a6b6a9a9b53e9

SHA256
fe53e36c3d6fe6c4ac4018d616026eaa9b812f79f7050672827c97cfea982bc6

SHA512
c0c98d82521d2ec6ab5818c8d20492cc839405ee70805b5f888251bee4358db3faf0afc9d4a78088d3c0014204ac9d39e7b7fb9decaa013a7b8acbeacfa499b7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f5f563ab-8370-4daa-939e-05085f5b46bb}\0.1.filtertrie.intermediate.txt.420

Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f5f563ab-8370-4daa-939e-05085f5b46bb}\0.2.filtertrie.intermediate.txt.420

Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837687940046.txt.420

Filesize
77KB

MD5
f02236d4405a64d5d517446b74c7d9e9

SHA1
916bb004951fc6c239cc710aeceaa2230b0bf19d

SHA256
4bfc4df0bdb17685d97b9926b56ca29ed0ad4096ec9d94a6b2043e2c72a04c9b

SHA512
7717eb30b6636be3b1293449c91abdbdbff7ec7c4bf869818814dbef1d7ea74ec33ace21f3a805fa600bd1db2c1a8b5d6c4792d4f39c3061a40b3d0e0b619080

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839712016426.txt.420

Filesize
47KB

MD5
22e53dc5709ced95e3c83af5804336a6

SHA1
0163069ed72c9616e06d8997c1f5d7fba597b0e0

SHA256
a128f39f65bd1068191be32727905f92217b625bde930a65ffae3250ec557373

SHA512
ce53d6e40b75737475193824dba4026508f9315be3a79698c3f5529863fad78bec5456b7e6f5971b08d5df5d753bc3dfe83dfa0aecb180d67ce970f6f2ef8dea

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846092837203.txt.420

Filesize
66KB

MD5
4a90573d4e1350bb3cb06a825fbd66de

SHA1
3f3ce3606d802cd06dda067fa2a07dfa745c90df

SHA256
5a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242

SHA512
b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579867951712963.txt.420

Filesize
75KB

MD5
ab69555e8ae9d8ff1de5605724761c5f

SHA1
3e09f9b5cfaf45fb19a8ff5c3ff884f570015171

SHA256
358df7dc00b3290428a7551c7ea07259efbcd6afee694654809819d1ef6604e5

SHA512
5c372847305cf5157b59e0479367560e3e36291055c93f80e41c33d2a711d35d2009cf314b06ec0c5b925d690957d14ee86218d9b4f9afb1d8883f70cd05793b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588659102808412.txt.420

Filesize
75KB

MD5
f8986559f15db3a6c0812096578ed41e

SHA1
54d7afa68254af0873ae6537812dcaffaebb391e

SHA256
a72f3d9014b8f543f2d3a998961442e542f5336093ac36ba14b72be59b3d2195

SHA512
cbaf9208e832504f710be8515d8c56aeb282ca91adc9d0a01134096a1da90a6d574228acb31db265ebc3e701f4e869461c420e4bb606014e4a57a4a75dc90e55

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588659382340530.txt.420

Filesize
62KB

MD5
eddd87ee089591cd1781db7f06ebb1d1

SHA1
a897b6df5b26c7d20d70691821c2f14dc1bb16d9

SHA256
df9cc88044e44ec23e60c22b361f5c27ee21f3354f6791f782fdf5e2bd03c95c

SHA512
c510df837d8486a4ed19f20bf38cb135df53f5aad9377c1056422ffd40d3900f1ff666431e86734e7d338256498ab8d8739da802f3f8a9ae101af8a851772da1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510733.txt.420

Filesize
16B

MD5
bea21141aa401823a718b5744650822b

SHA1
bbe9cee4379b81dcf6fdf92aff28f2209563ce50

SHA256
57535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe

SHA512
281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070740298.html.420

Filesize
93KB

MD5
26867c65bfa6c8f5ed42e7eb935855c7

SHA1
75fe07221b6cf09e3cafe5349b86e44f4c25c025

SHA256
91b20caf24d5cfb3b3278b1c8e5cce58833ed2b7caeadfade89128ad23b13a57

SHA512
ec05007612ec6ffab2a2e5014f1d0ec9c54f2a5f899c61ed786dfea752490b7b9ad8bbe16d759494a40ea687c301c6590494344ba81f45eba3c1c9685b3245a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sovqivsy.ddz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420

Filesize
1KB

MD5
3c093adacb94e332dbeceb7b03b0da26

SHA1
842a28e3bb82675bd64a8c28faa340b4575cef0c

SHA256
4802a6915ed73e4e27de206f052b796406f2298da035e6f437e1e1c9d8370635

SHA512
17e1948172d381f24471959dc17d538e965e0d66d05a6fc8635c0672672358c36d233fa66ed40d6a7e3291f017797e5e0e2dd9a1ebdad00de14e935638250926

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI23F5.txt.420

Filesize
426KB

MD5
641cefbf5e9878a3b9cdd13e0c2a2e32

SHA1
e10c558429c359ba246cd5fec16f68a4983355cc

SHA256
fc6ad1f86ba7d101762d2fdbad685cd70aa28d389054bce197cb3b23a09860cd

SHA512
7d593c6de6de5612147114b14211145a0fc05cd6be5b043574c872f05c7461b9199dd0fe3c483739a88c90709d2e24ed6d8851adf18ad09f3b4165c38751c8e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2413.txt.420

Filesize
414KB

MD5
7aff10eedd9b996eb2974b4520949915

SHA1
a4c7d7f605cc6f54f0d0a5e5c1adf9fa7dba53c0

SHA256
0cb89c5a1a351b70849f4d6eb3210279d36e8a36a008a6e26fe460e9b5fda2e6

SHA512
0bf12093be4777b3d5cd0956ab910bcbf2d74b41cc9a917727ed509a941b8ab0491e7681f3caf58ff699753e05abcc4208d277d0b9e8d2216271dfe524b82fb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI23F5.txt.420

Filesize
11KB

MD5
9ea6de139710bebdeefe390808e02c54

SHA1
0f2d6d2646c658dfaeb80b5a6693710e08bd3a5d

SHA256
0d499195cfaf0375a0ef85a0bde2a535fc1184380851a7d7b30287e7ae656129

SHA512
6a14df50e6a7f701f4c6c68fa5048dc00f4c53969743f391765d217e606168b0408a8cd4a3ff669c0b946540a59689d89cccea794ed01c8cdcefc43cd15ebb39

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2413.txt.420

Filesize
11KB

MD5
ed1dfbc5333a514b808a5f6914892429

SHA1
710a0c14f09ca1cd0487063c11315d26db09a014

SHA256
034db0a1ed6111daa2bccb621e2fce189264d0494fd75e1c7022ffbf99989e45

SHA512
bfe5676f369361b7eb550681ead0b3c455c99dc399529c56478d3616c02c1afbbce7a8db6136a236185547051c7d713cea987baad4d82bdd52fb381292368983

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420

Filesize
16B

MD5
65e115805f15f9cda5eb01e8f742d121

SHA1
e3ecf29bfa71ce07baf8d02009afb8766f35981b

SHA256
7852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a

SHA512
dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\mapping.csv.420

Filesize
120KB

MD5
42c12f9e321e00ee8f2ec180e7863e24

SHA1
8d32c5df1057f7d040c919fbea6af11a274d2374

SHA256
63f8f0d578669353be78d86d0173e8f49202fd56f88d36bbefcae31b55d9ac8a

SHA512
c917ed0f9013642a6fe7968315d8454db9173b75e54184449682f75d8e5c02bdc77895e08e15eeb595de6811c09c5fbe0b85982e664223e28d351d2dd10225b2

Download Submit
C:\Users\Admin\AppData\Roaming\DenySet.xml.420

Filesize
1.1MB

MD5
5c4293d302e571dedae1c798c2537c98

SHA1
393cfc5f25fa89fa6bac21b315f73be6dea09734

SHA256
7c54b7261b961c73dfb077cd1405d6f2e5fce0555badc8455cbef9e0ff79e905

SHA512
6d8128713bd913a425ecaed4e4b985416490c5f5d9657d49ca0705afb0c4dddddd01210b949de52152565ec8c4e8f029c3e4279642021c0d013b33798dcbfcb5

Download Submit
C:\Users\Admin\AppData\Roaming\GrantReset.xml.420

Filesize
547KB

MD5
8aa0b5d4801f39fdcf97faba9447e8bf

SHA1
030dc37f20e7919069be0dcd58dcf4046dbc971e

SHA256
641af887ee5b18936aa08d8747d7e538f667ac835c3b3c2967ba33adc62d74d1

SHA512
c4da9e1d24df315a3fa6367dc9d758beb171b992843d1e55606214f871f3c453aa365bfea64cfc3c372d5bde5b33be66cf1b614f07430f86da6fe882fb8a80d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420

Filesize
112KB

MD5
7490a7341f638b17a8bb0c59ccd94b4b

SHA1
aff746951ce73111f9d6f5499c8490a5deabd425

SHA256
12926f45b143b17cee497c4ebf9ab1b40511f8da8d90f7cd36acaa19ae385221

SHA512
77af99b464073d60c1d3b23507564d3d14aaa186326ad5a00d0023aadd9cb120f6783a5ec6c138128fc7f0dec5ab63b3a136d0af79236f231e649d7383a10889

Download Submit
C:\Users\Admin\Desktop\EncryptedLog.txt

Filesize
163B

MD5
afb71a2cff969da58f751266a6f59688

SHA1
a675b4f2f1ec8e682f42b380b7f57d8c8cd1c085

SHA256
ed688191f72c45ff92920d6674010998b056f9b5c25eebe0f3317a2e905b3088

SHA512
6e1e7dbc2cdb86a0929f46ca2ee1b1bc56a284ed4bb882be8043b2d40ff4ba5d56d0fdbe5dcd00838b80832141de51ead92b4b1f19a0e6bf770930f1287bf5ee

Download Submit
C:\Users\Admin\Links\Desktop.lnk.420

Filesize
512B

MD5
fa5c6aa77211400eeb94231ae46d2231

SHA1
34638c1e127c17cd65dfb6545568784f3dabff79

SHA256
dcf6ac17d0c60c5293aeadc2e8a3c2b9eaca477e72cf8b501b5c96886dbc733b

SHA512
15c1fc763e5a646cf5d670a4022f99aaab1835a82b84cf683d3c738c308bbf63997d067caea0a0234458312af7c039b837cbdcc65d2e3222e27598277b796e06

Download Submit
C:\Users\Admin\Links\Downloads.lnk.420

Filesize
960B

MD5
b0b2a4e624146e2612cecbd82b2190c0

SHA1
3cd9050bfe67328add8ce0360beb5ce50307a74e

SHA256
f6b0862d170c64ff5416365bbe2af1ad4259d4182df4581edba2cd7efb596e17

SHA512
2ea66ff318c15ffd5c4491a88f80e666b59c4cd193e56ae6612d06537843423224c49f40f3c0b82c086f396d528b2926328893ee2075d93dc7af5ae8bccd2901

Download Submit
C:\Windows\System32\Seven.dll

Filesize
1.0MB

MD5
d04365e7e8c75d762fe957fed1567250

SHA1
002612ecc3a639af74ce1ddd0e2dc4ddc23c0253

SHA256
2ba7535cdd2adf5eab33c8689269f839bd79cc5346bd9d0b138f18717bc69e3d

SHA512
995a31332dd35f6b8de2e2cb51bb097c523cd6d7936c84bb9423fc384b820fb63134e4a7d93c9dbbe80f8b90eab61e38fdb2c006b27b57767292f5fa8788686f

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json

Filesize
458B

MD5
07b9a30265ca4e69c7016a1b6e3ffc27

SHA1
3a4af82a2695b1423aedd8b60a5c86793c011b02

SHA256
c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782

SHA512
efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c

Download Submit
C:\Windows\System32\Winhost.exe

Filesize
139KB

MD5
6503f847c3281ff85b304fc674b62580

SHA1
947536e0741c085f37557b7328b067ef97cb1a61

SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

Download Submit
memory/1916-10-0x00000282F7E10000-0x00000282F7E32000-memory.dmp

Filesize
136KB

Download
memory/1916-13-0x00000282F5E30000-0x00000282F5E40000-memory.dmp

Filesize
64KB

Download
memory/1916-12-0x00000282F5E30000-0x00000282F5E40000-memory.dmp

Filesize
64KB

Download
memory/1916-11-0x00007FFDD0CA0000-0x00007FFDD1761000-memory.dmp

Filesize
10.8MB

Download
memory/1916-16-0x00007FFDD0CA0000-0x00007FFDD1761000-memory.dmp

Filesize
10.8MB

Download
memory/17476-461-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/17524-474-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/17540-475-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/17632-466-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/17656-470-0x00007FFDF1DF0000-0x00007FFDF1FE5000-memory.dmp

Filesize
2.0MB

Download
memory/17656-465-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/17964-463-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/17988-472-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/18080-464-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/18176-467-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/18336-468-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/18352-469-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/18404-462-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download
memory/18424-473-0x00007FF7B25B0000-0x00007FF7B2617000-memory.dmp

Filesize
412KB

Download