9370fe54c728824407f39911360b1a704ffbec488fbe83623204b8ca4758e69f

Analysis

max time kernel
212s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

350273e0d2e8a9ba5e37b791016112a0
SHA1

5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
SHA256

27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
SHA512

b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Winhost.exe

Deletes itself 1 IoCs

pid	Process
2724	Winhost.exe

Executes dropped EXE 64 IoCs

pid	Process
2724	Winhost.exe
15368	Winhost.exe
2432	Winhost.exe
5828	Winhost.exe
15100	Winhost.exe
408	Winhost.exe
18360	Winhost.exe
17540	Winhost.exe
15500	Winhost.exe
15192	Winhost.exe
15668	Winhost.exe
5020	Winhost.exe
11552	Winhost.exe
3348	Winhost.exe
6108	Winhost.exe
7124	Winhost.exe
16412	Winhost.exe
6856	Winhost.exe
16340	Winhost.exe
5476	Winhost.exe
15680	Winhost.exe
1508	Winhost.exe
6936	Winhost.exe
5380	Winhost.exe
19400	Winhost.exe
6368	Winhost.exe
9708	Winhost.exe
6040	Winhost.exe
15280	Winhost.exe
5568	Winhost.exe
16044	Winhost.exe
6500	Winhost.exe
5812	Winhost.exe
6340	Winhost.exe
6800	Winhost.exe
16152	Winhost.exe
5844	Winhost.exe
16364	Winhost.exe
9060	Winhost.exe
3088	Winhost.exe
8984	Winhost.exe
16216	Winhost.exe
13952	Winhost.exe
16212	Winhost.exe
7888	Winhost.exe
9068	Winhost.exe
7084	Winhost.exe
5108	Winhost.exe
17132	Winhost.exe
9324	Winhost.exe
19140	Winhost.exe
12696	Winhost.exe
8684	Winhost.exe
7148	Winhost.exe
8060	Winhost.exe
16400	Winhost.exe
7748	Winhost.exe
4928	Winhost.exe
4396	Winhost.exe
7376	Winhost.exe
1916	Winhost.exe
15888	Winhost.exe
7816	Winhost.exe
10732	Winhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Winhost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Winhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\System32\Winhost.exe	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File opened for modification	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\System32\Seven.dll	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe
File created	C:\Windows\system32\KeyAndIV.txt	Winhost.exe
File created	C:\Windows\system32\EncryptedLog.txt	Winhost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpaa2bx4.tmp"	Seven.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	powershell.exe
5084	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3484	1412	Seven.exe	86
PID 1412 wrote to memory of 3484	1412	Seven.exe	86
PID 1412 wrote to memory of 5084	1412	Seven.exe	87
PID 1412 wrote to memory of 5084	1412	Seven.exe	87
PID 1412 wrote to memory of 5080	1412	Seven.exe	89
PID 1412 wrote to memory of 5080	1412	Seven.exe	89
PID 1412 wrote to memory of 444	1412	Seven.exe	90
PID 1412 wrote to memory of 444	1412	Seven.exe	90
PID 1412 wrote to memory of 2160	1412	Seven.exe	91
PID 1412 wrote to memory of 2160	1412	Seven.exe	91
PID 1412 wrote to memory of 4936	1412	Seven.exe	92
PID 1412 wrote to memory of 4936	1412	Seven.exe	92
PID 1412 wrote to memory of 3176	1412	Seven.exe	93
PID 1412 wrote to memory of 3176	1412	Seven.exe	93
PID 1412 wrote to memory of 4908	1412	Seven.exe	94
PID 1412 wrote to memory of 4908	1412	Seven.exe	94
PID 1412 wrote to memory of 3672	1412	Seven.exe	95
PID 1412 wrote to memory of 3672	1412	Seven.exe	95
PID 2160 wrote to memory of 4040	2160	cmd.exe	96
PID 2160 wrote to memory of 4040	2160	cmd.exe	96
PID 3672 wrote to memory of 5092	3672	cmd.exe	97
PID 3672 wrote to memory of 5092	3672	cmd.exe	97
PID 4908 wrote to memory of 1824	4908	cmd.exe	98
PID 4908 wrote to memory of 1824	4908	cmd.exe	98
PID 1412 wrote to memory of 2724	1412	Seven.exe	101
PID 1412 wrote to memory of 2724	1412	Seven.exe	101
PID 2724 wrote to memory of 3876	2724	Winhost.exe	104
PID 2724 wrote to memory of 3876	2724	Winhost.exe	104
PID 2724 wrote to memory of 5004	2724	Winhost.exe	106
PID 2724 wrote to memory of 5004	2724	Winhost.exe	106
PID 2724 wrote to memory of 3436	2724	Winhost.exe	107
PID 2724 wrote to memory of 3436	2724	Winhost.exe	107
PID 2724 wrote to memory of 3632	2724	Winhost.exe	109
PID 2724 wrote to memory of 3632	2724	Winhost.exe	109
PID 2724 wrote to memory of 1364	2724	Winhost.exe	111
PID 2724 wrote to memory of 1364	2724	Winhost.exe	111
PID 2724 wrote to memory of 2076	2724	Winhost.exe	112
PID 2724 wrote to memory of 2076	2724	Winhost.exe	112
PID 2724 wrote to memory of 1528	2724	Winhost.exe	805
PID 2724 wrote to memory of 1528	2724	Winhost.exe	805
PID 2724 wrote to memory of 408	2724	Winhost.exe	815
PID 2724 wrote to memory of 408	2724	Winhost.exe	815
PID 2724 wrote to memory of 3152	2724	Winhost.exe	119
PID 2724 wrote to memory of 3152	2724	Winhost.exe	119
PID 2724 wrote to memory of 2432	2724	Winhost.exe	121
PID 2724 wrote to memory of 2432	2724	Winhost.exe	121
PID 2724 wrote to memory of 1840	2724	Winhost.exe	123
PID 2724 wrote to memory of 1840	2724	Winhost.exe	123
PID 3876 wrote to memory of 4724	3876	cmd.exe	124
PID 3876 wrote to memory of 4724	3876	cmd.exe	124
PID 2724 wrote to memory of 1624	2724	Winhost.exe	125
PID 2724 wrote to memory of 1624	2724	Winhost.exe	125
PID 2724 wrote to memory of 560	2724	Winhost.exe	126
PID 2724 wrote to memory of 560	2724	Winhost.exe	126
PID 2724 wrote to memory of 4256	2724	Winhost.exe	128
PID 2724 wrote to memory of 4256	2724	Winhost.exe	128
PID 2724 wrote to memory of 1980	2724	Winhost.exe	131
PID 2724 wrote to memory of 1980	2724	Winhost.exe	131
PID 2724 wrote to memory of 1960	2724	Winhost.exe	132
PID 2724 wrote to memory of 1960	2724	Winhost.exe	132
PID 3632 wrote to memory of 4800	3632	cmd.exe	696
PID 3632 wrote to memory of 4800	3632	cmd.exe	696
PID 4256 wrote to memory of 2796	4256	cmd.exe	138
PID 4256 wrote to memory of 2796	4256	cmd.exe	138

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4040	attrib.exe
1824	attrib.exe
5092	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1412
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\\Windows\\System32\\Winhost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\Winhost.exe
  2⤵
  PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\Winhost.exe
  2⤵
  - Drops file in System32 directory
  PID:444
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Winhost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Winhost.exe
    3⤵
    - Views/modifies file attributes
    PID:4040
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
  2⤵
  - Drops file in System32 directory
  PID:4936
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
  2⤵
  PID:3176
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Seven.dll
    3⤵
    - Views/modifies file attributes
    PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Seven.runtimeconfig.json
    3⤵
    - Views/modifies file attributes
    PID:5092
- C:\Users\Admin\AppData\Local\Temp\Winhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4724
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
    3⤵
    PID:5004
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
    3⤵
    PID:3436
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
    3⤵
    PID:1364
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1336
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
    3⤵
    PID:2076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5060
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
    3⤵
    PID:1528
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2052
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
    3⤵
    PID:408
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
    3⤵
    PID:3152
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
    3⤵
    PID:2432
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3172
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
    3⤵
    PID:1840
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
    3⤵
    PID:1624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1724
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
    3⤵
    PID:560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
    3⤵
    PID:1980
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
    3⤵
    PID:1960
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
    3⤵
    PID:1452
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\OpenApprove.xml"
    3⤵
    PID:4508
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ResumeBackup.docx"
    3⤵
    PID:2664
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9468
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\StartMount.txt"
    3⤵
    PID:4108
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\WaitResume.doc"
    3⤵
    PID:4420
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
    3⤵
    PID:1548
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ConvertFromRegister.pptx"
    3⤵
    PID:1824
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
    3⤵
    PID:4600
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9028
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
    3⤵
    PID:4840
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
    3⤵
    PID:4808
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9308
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RequestDismount.xls"
    3⤵
    PID:4932
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9292
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SkipInitialize.pdf"
    3⤵
    PID:4376
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
    3⤵
    PID:4448
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UseConnect.xlsx"
    3⤵
    PID:5072
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\EnableOut.doc"
    3⤵
    PID:2296
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\OptimizeMove.lnk"
    3⤵
    PID:536
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10044
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\StopResize.odt"
    3⤵
    PID:4484
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
    3⤵
    PID:4208
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10748
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
    3⤵
    PID:4280
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\CompressShow.odt"
    3⤵
    PID:4240
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\EditSend.xls"
    3⤵
    PID:2628
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ExpandEdit.html"
    3⤵
    PID:3880
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\UnlockResize.jpg"
    3⤵
    PID:924
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11016
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\ApproveRestore.png"
    3⤵
    PID:1316
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\EnableApprove.bmp"
    3⤵
    PID:2400
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
    3⤵
    PID:3168
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\PingRestore.bmp"
    3⤵
    PID:4372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RestartReceive.jpg"
    3⤵
    PID:1436
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135659.txt"
    3⤵
    PID:3648
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12124
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
    3⤵
    PID:5128
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11276
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI478B.txt"
    3⤵
    PID:5148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11848
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI47AF.txt"
    3⤵
    PID:5168
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1368
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI478B.txt"
    3⤵
    PID:5184
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI47AF.txt"
    3⤵
    PID:5204
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11516
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
    3⤵
    PID:5216
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124305829.html"
    3⤵
    PID:5228
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
    3⤵
    PID:5264
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
    3⤵
    PID:5276
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"
    3⤵
    PID:5372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
    3⤵
    PID:5400
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12844
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
    3⤵
    PID:5416
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
    3⤵
    PID:5460
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
    3⤵
    PID:5472
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
    3⤵
    PID:5508
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12412
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
    3⤵
    PID:5536
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
    3⤵
    PID:5580
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12788
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
    3⤵
    PID:5604
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11524
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
    3⤵
    PID:5628
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
    3⤵
    PID:5648
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
    3⤵
    PID:5660
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
    3⤵
    PID:5672
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
    3⤵
    PID:5684
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
    3⤵
    PID:5704
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11876
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
    3⤵
    PID:5720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12728
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
    3⤵
    PID:5740
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
    3⤵
    PID:5752
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
    3⤵
    PID:5780
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12420
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
    3⤵
    PID:5804
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12812
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
    3⤵
    PID:5820
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
    3⤵
    PID:5836
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
    3⤵
    PID:5860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
    3⤵
    PID:5876
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13156
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
    3⤵
    PID:5896
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
    3⤵
    PID:5912
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
    3⤵
    PID:5928
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:10516
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
    3⤵
    PID:6088
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
    3⤵
    PID:5444
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12976
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
    3⤵
    PID:5856
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
    3⤵
    PID:6104
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
    3⤵
    PID:6160
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
    3⤵
    PID:6180
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
    3⤵
    PID:6252
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
    3⤵
    PID:6272
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
    3⤵
    PID:6284
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12936
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
    3⤵
    PID:6376
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13180
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
    3⤵
    PID:6412
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13128
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
    3⤵
    PID:6432
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12772
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
    3⤵
    PID:6460
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
    3⤵
    PID:6476
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13172
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
    3⤵
    PID:6672
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13524
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
    3⤵
    PID:6688
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
    3⤵
    PID:6704
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13164
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
    3⤵
    PID:6724
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
    3⤵
    PID:6880
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14900
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
    3⤵
    PID:2312
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14168
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
    3⤵
    PID:5252
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14052
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
    3⤵
    PID:6876
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
    3⤵
    PID:7296
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
    3⤵
    PID:7312
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
    3⤵
    PID:7324
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
    3⤵
    PID:7336
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
    3⤵
    PID:7348
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14908
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
    3⤵
    PID:7360
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
    3⤵
    PID:7372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14768
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
    3⤵
    PID:7392
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
    3⤵
    PID:7408
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14664
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
    3⤵
    PID:7428
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
    3⤵
    PID:7444
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4972
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
    3⤵
    PID:7464
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
    3⤵
    PID:7480
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14648
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
    3⤵
    PID:7500
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14120
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
    3⤵
    PID:7520
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
    3⤵
    PID:7540
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14072
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
    3⤵
    PID:7556
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14656
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
    3⤵
    PID:7580
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14420
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
    3⤵
    PID:7592
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14692
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
    3⤵
    PID:7604
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14672
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
    3⤵
    PID:7624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
    3⤵
    PID:8048
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
    3⤵
    PID:8128
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
    3⤵
    PID:8140
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15200
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
    3⤵
    PID:7440
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
    3⤵
    PID:8324
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14820
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
    3⤵
    PID:8408
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1528
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
    3⤵
    PID:8420
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
    3⤵
    PID:8432
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15176
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
    3⤵
    PID:8444
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
    3⤵
    PID:8456
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
    3⤵
    PID:8468
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
    3⤵
    PID:8480
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15216
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
    3⤵
    PID:8496
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
    3⤵
    PID:8532
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
    3⤵
    PID:8576
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:972
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
    3⤵
    PID:8588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
    3⤵
    PID:8600
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
    3⤵
    PID:8612
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
    3⤵
    PID:8624
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
    3⤵
    PID:8636
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15168
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
    3⤵
    PID:8648
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
    3⤵
    PID:8716
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085469976121.txt"
    3⤵
    PID:8732
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086161947981.txt"
    3⤵
    PID:8956
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086538948269.txt"
    3⤵
    PID:8976
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086733527393.txt"
    3⤵
    PID:8992
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:7528
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086821031652.txt"
    3⤵
    PID:9012
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12228
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086855514198.txt"
    3⤵
    PID:9032
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586087030783790.txt"
    3⤵
    PID:9044
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586087116936491.txt"
    3⤵
    PID:8524
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088255981393.txt"
    3⤵
    PID:8428
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088913562989.txt"
    3⤵
    PID:8712
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14824
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092380013040.txt"
    3⤵
    PID:8632
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092688753844.txt"
    3⤵
    PID:9436
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092988676994.txt"
    3⤵
    PID:9448
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5596
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093516727185.txt"
    3⤵
    PID:9460
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:7252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093932041758.txt"
    3⤵
    PID:9480
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15456
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586094114823710.txt"
    3⤵
    PID:9492
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095412638284.txt"
    3⤵
    PID:9504
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14020
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095711983351.txt"
    3⤵
    PID:9560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096013397188.txt"
    3⤵
    PID:9576
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:408
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096312391701.txt"
    3⤵
    PID:9592
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586097090598174.txt"
    3⤵
    PID:9604
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15604
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586139557781446.txt"
    3⤵
    PID:9616
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
    3⤵
    PID:9640
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
    3⤵
    PID:9656
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15596
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
    3⤵
    PID:9676
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\AlternateServices.txt"
    3⤵
    PID:9692
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\pkcs11.txt"
    3⤵
    PID:9708
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\SiteSecurityServiceState.txt"
    3⤵
    PID:9724
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15424
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SG9GK5FX\known_providers_download_v1[1].xml"
    3⤵
    PID:9736
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3956
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SG9GK5FX\update100[1].xml"
    3⤵
    PID:9748
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
    3⤵
    PID:9760
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
    3⤵
    PID:9776
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15512
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
    3⤵
    PID:9804
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
    3⤵
    PID:9820
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
    3⤵
    PID:9840
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15540
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
    3⤵
    PID:9852
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
    3⤵
    PID:9868
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15564
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
    3⤵
    PID:9880
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{10eeac87-588c-4980-aa7d-5120db29005a}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:9900
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15344
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{10eeac87-588c-4980-aa7d-5120db29005a}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:9920
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{10eeac87-588c-4980-aa7d-5120db29005a}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:9932
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9288d4c0-bdf0-4329-952a-6c7d6a0cc14b}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:9944
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15416
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9288d4c0-bdf0-4329-952a-6c7d6a0cc14b}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:9956
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9288d4c0-bdf0-4329-952a-6c7d6a0cc14b}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:9968
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15556
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:9980
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:9992
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:10004
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\appsconversions.txt"
    3⤵
    PID:10016
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\appsglobals.txt"
    3⤵
    PID:10036
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\appssynonyms.txt"
    3⤵
    PID:10212
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\settingsconversions.txt"
    3⤵
    PID:10224
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\settingsglobals.txt"
    3⤵
    PID:10236
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\settingssynonyms.txt"
    3⤵
    PID:9184
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3de6c2d5-4760-44d2-a3c3-854eee3655f9}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:9600
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3de6c2d5-4760-44d2-a3c3-854eee3655f9}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:9652
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15708
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3de6c2d5-4760-44d2-a3c3-854eee3655f9}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:9756
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1232
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a071ad59-d4f9-4b90-809d-9a64b4020cd6}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:9896
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a071ad59-d4f9-4b90-809d-9a64b4020cd6}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:9672
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a071ad59-d4f9-4b90-809d-9a64b4020cd6}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:9796
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15572
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
    3⤵
    PID:10260
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
    3⤵
    PID:10272
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
    3⤵
    PID:10560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
    3⤵
    PID:10580
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
    3⤵
    PID:10596
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15788
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
    3⤵
    PID:9816
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15820
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
    3⤵
    PID:9928
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15648
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
    3⤵
    PID:10032
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
    3⤵
    PID:10064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
    3⤵
    PID:3652
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2824
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
    3⤵
    PID:10556
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3372
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
    3⤵
    PID:9912
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15984
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
    3⤵
    PID:4976
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
    3⤵
    PID:9500
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
    3⤵
    PID:9444
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3364
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
    3⤵
    PID:11452
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
    3⤵
    PID:11708
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15908
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
    3⤵
    PID:11720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16288
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3IAR76WG\microsoft.windows[1].xml"
    3⤵
    PID:11736
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MSMWM9H0\www.bing[1].xml"
    3⤵
    PID:11760
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
    3⤵
    PID:11784
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
    3⤵
    PID:11972
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4392
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
    3⤵
    PID:11984
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
    3⤵
    PID:12004
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:748
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
    3⤵
    PID:12020
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
    3⤵
    PID:12040
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
    3⤵
    PID:12056
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
    3⤵
    PID:12068
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
    3⤵
    PID:12140
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
    3⤵
    PID:12204
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
    3⤵
    PID:12232
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16372
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
    3⤵
    PID:12244
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
    3⤵
    PID:12264
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
    3⤵
    PID:12284
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
    3⤵
    PID:3888
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
    3⤵
    PID:1008
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15656
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
    3⤵
    PID:10268
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
    3⤵
    PID:11124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
    3⤵
    PID:12596
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
    3⤵
    PID:12612
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16596
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
    3⤵
    PID:13036
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
    3⤵
    PID:13268
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
    3⤵
    PID:13284
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
    3⤵
    PID:13300
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
    3⤵
    PID:11964
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16696
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
    3⤵
    PID:11752
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
    3⤵
    PID:4800
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
    3⤵
    PID:11488
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
    3⤵
    PID:12200
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16688
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
    3⤵
    PID:12224
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
    3⤵
    PID:1416
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
    3⤵
    PID:13328
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
    3⤵
    PID:13588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17120
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
    3⤵
    PID:13700
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
    3⤵
    PID:13848
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16604
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
    3⤵
    PID:13864
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
    3⤵
    PID:13928
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17128
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
    3⤵
    PID:13940
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16768
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
    3⤵
    PID:13956
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
    3⤵
    PID:13972
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17168
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
    3⤵
    PID:13988
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:880
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
    3⤵
    PID:14008
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1516
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
    3⤵
    PID:14024
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16924
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
    3⤵
    PID:14064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
    3⤵
    PID:14084
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16712
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
    3⤵
    PID:14112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17176
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
    3⤵
    PID:14132
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
    3⤵
    PID:14144
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16524
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
    3⤵
    PID:14160
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
    3⤵
    PID:14180
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:17152
- - C:\Users\Admin\AppData\Local\Temp\Winhost.exe
    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
    3⤵
    - Executes dropped EXE
    PID:15368
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
      4⤵
      PID:17308
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
      4⤵
      PID:17324
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135659.txt"
      4⤵
      PID:17340
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
      4⤵
      PID:17356
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:3332
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI478B.txt"
      4⤵
      PID:17380
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18564
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI47AF.txt"
      4⤵
      PID:17404
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI478B.txt"
      4⤵
      PID:5048
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:8832
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI47AF.txt"
      4⤵
      PID:4880
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
      4⤵
      PID:3004
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:15316
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124305829.html"
      4⤵
      PID:1452
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
      4⤵
      PID:9296
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:11388
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
      4⤵
      PID:9212
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"
      4⤵
      PID:9028
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
      4⤵
      PID:3620
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
      4⤵
      PID:380
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
      4⤵
      PID:2108
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
      4⤵
      PID:820
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
      4⤵
      PID:3480
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
      4⤵
      PID:4600
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
      4⤵
      PID:4508
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
      4⤵
      PID:1096
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
      4⤵
      PID:10952
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18788
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
      4⤵
      PID:11064
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
      4⤵
      PID:11068
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:9148
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
      4⤵
      PID:9292
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:10748
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
      4⤵
      PID:9308
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:9404
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
      4⤵
      PID:5320
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
      4⤵
      PID:5336
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
      4⤵
      PID:5236
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:13436
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
      4⤵
      PID:2808
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
      4⤵
      PID:4320
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
      4⤵
      PID:10744
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
      4⤵
      PID:3176
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:12444
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
      4⤵
      PID:17284
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
      4⤵
      PID:4840
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
      4⤵
      PID:4676
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
      4⤵
      PID:5316
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18288
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
      4⤵
      PID:3936
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
      4⤵
      PID:10492
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3468
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
      4⤵
      PID:7516
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
      4⤵
      PID:6804
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
      4⤵
      PID:5388
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
      4⤵
      PID:3332
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
      4⤵
      PID:17304
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
      4⤵
      PID:17352
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
      4⤵
      PID:9860
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:10500
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
      4⤵
      PID:2328
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
      4⤵
      PID:1548
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
      4⤵
      PID:4848
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
      4⤵
      PID:5112
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
      4⤵
      PID:3764
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
      4⤵
      PID:1752
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
      4⤵
      PID:5332
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
      4⤵
      PID:6192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
      4⤵
      PID:17420
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
      4⤵
      PID:17436
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
      4⤵
      PID:17464
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
      4⤵
      PID:17480
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
      4⤵
      PID:17492
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
      4⤵
      PID:17504
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
      4⤵
      PID:17516
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
      4⤵
      PID:17528
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
      4⤵
      PID:17548
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
      4⤵
      PID:17560
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
      4⤵
      PID:17580
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
      4⤵
      PID:17612
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
      4⤵
      PID:17624
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
      4⤵
      PID:17636
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
      4⤵
      PID:17648
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
      4⤵
      PID:17660
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
      4⤵
      PID:17672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
      4⤵
      PID:17684
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
      4⤵
      PID:17696
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
      4⤵
      PID:17712
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:12944
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
      4⤵
      PID:17724
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
      4⤵
      PID:17736
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
      4⤵
      PID:17752
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
      4⤵
      PID:17768
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
      4⤵
      PID:17784
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
      4⤵
      PID:17796
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
      4⤵
      PID:17808
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
      4⤵
      PID:17824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
      4⤵
      PID:17840
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
      4⤵
      PID:17860
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
      4⤵
      PID:17872
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
      4⤵
      PID:17892
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
      4⤵
      PID:17908
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
      4⤵
      PID:17924
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:3468
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
      4⤵
      PID:17940
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
      4⤵
      PID:17964
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
      4⤵
      PID:17976
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
      4⤵
      PID:17988
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
      4⤵
      PID:18000
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4808
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
      4⤵
      PID:18012
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
      4⤵
      PID:18024
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
      4⤵
      PID:18036
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
      4⤵
      PID:18048
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
      4⤵
      PID:18060
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
      4⤵
      PID:18072
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
      4⤵
      PID:18084
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
      4⤵
      PID:18096
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
      4⤵
      PID:18108
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
      4⤵
      PID:18120
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085469976121.txt"
      4⤵
      PID:18132
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086161947981.txt"
      4⤵
      PID:18144
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086538948269.txt"
      4⤵
      PID:18156
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:15024
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086733527393.txt"
      4⤵
      PID:18168
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086821031652.txt"
      4⤵
      PID:18180
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086855514198.txt"
      4⤵
      PID:18192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586087030783790.txt"
      4⤵
      PID:18204
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586087116936491.txt"
      4⤵
      PID:18216
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088255981393.txt"
      4⤵
      PID:18228
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088913562989.txt"
      4⤵
      PID:18240
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092380013040.txt"
      4⤵
      PID:18252
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092688753844.txt"
      4⤵
      PID:18264
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092988676994.txt"
      4⤵
      PID:18276
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093516727185.txt"
      4⤵
      PID:18288
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093932041758.txt"
      4⤵
      PID:18300
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:13824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586094114823710.txt"
      4⤵
      PID:18312
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095412638284.txt"
      4⤵
      PID:18332
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095711983351.txt"
      4⤵
      PID:18348
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096013397188.txt"
      4⤵
      PID:18364
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096312391701.txt"
      4⤵
      PID:18384
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586097090598174.txt"
      4⤵
      PID:18400
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586139557781446.txt"
      4⤵
      PID:18416
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
      4⤵
      PID:17368
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:11852
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
      4⤵
      PID:5192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
      4⤵
      PID:1644
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\AlternateServices.txt"
      4⤵
      PID:10092
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\pkcs11.txt"
      4⤵
      PID:18448
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:8824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\SiteSecurityServiceState.txt"
      4⤵
      PID:18464
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SG9GK5FX\known_providers_download_v1[1].xml"
      4⤵
      PID:18480
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SG9GK5FX\update100[1].xml"
      4⤵
      PID:18500
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
      4⤵
      PID:18520
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:17348
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
      4⤵
      PID:18536
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:13884
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
      4⤵
      PID:18560
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
      4⤵
      PID:18576
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
      4⤵
      PID:18592
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
      4⤵
      PID:18620
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
      4⤵
      PID:18636
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
      4⤵
      PID:18656
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{10eeac87-588c-4980-aa7d-5120db29005a}\0.0.filtertrie.intermediate.txt"
      4⤵
      PID:18672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{10eeac87-588c-4980-aa7d-5120db29005a}\0.1.filtertrie.intermediate.txt"
      4⤵
      PID:18700
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{10eeac87-588c-4980-aa7d-5120db29005a}\0.2.filtertrie.intermediate.txt"
      4⤵
      PID:18716
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9288d4c0-bdf0-4329-952a-6c7d6a0cc14b}\0.0.filtertrie.intermediate.txt"
      4⤵
      PID:18732
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9288d4c0-bdf0-4329-952a-6c7d6a0cc14b}\0.1.filtertrie.intermediate.txt"
      4⤵
      PID:18756
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9288d4c0-bdf0-4329-952a-6c7d6a0cc14b}\0.2.filtertrie.intermediate.txt"
      4⤵
      PID:18772
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.0.filtertrie.intermediate.txt"
      4⤵
      PID:18784
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.1.filtertrie.intermediate.txt"
      4⤵
      PID:18808
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.2.filtertrie.intermediate.txt"
      4⤵
      PID:18824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\appsconversions.txt"
      4⤵
      PID:18844
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\appsglobals.txt"
      4⤵
      PID:18856
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\appssynonyms.txt"
      4⤵
      PID:18868
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\settingsconversions.txt"
      4⤵
      PID:18880
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\settingsglobals.txt"
      4⤵
      PID:18896
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{23e8bb93-e9fb-4496-84d5-38cd9f4eef5c}\settingssynonyms.txt"
      4⤵
      PID:18908
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3de6c2d5-4760-44d2-a3c3-854eee3655f9}\0.0.filtertrie.intermediate.txt"
      4⤵
      PID:18920
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3de6c2d5-4760-44d2-a3c3-854eee3655f9}\0.1.filtertrie.intermediate.txt"
      4⤵
      PID:18932
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3de6c2d5-4760-44d2-a3c3-854eee3655f9}\0.2.filtertrie.intermediate.txt"
      4⤵
      PID:18944
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:11844
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a071ad59-d4f9-4b90-809d-9a64b4020cd6}\0.0.filtertrie.intermediate.txt"
      4⤵
      PID:18956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 15368 -ip 15368
1⤵
PID:11064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 696 -p 18052 -ip 18052
1⤵
PID:9100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 760 -p 17956 -ip 17956
1⤵
PID:4320

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1108 -p 17972 -ip 17972
1⤵
PID:17324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1136 -p 2112 -ip 2112
1⤵
PID:12124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:12796

C:\Windows\System32\Winhost.exe
C:\Windows\System32\Winhost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2432
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588871584840947.txt"
  2⤵
  PID:14928
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:13936
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588871874590994.txt"
  2⤵
  PID:12952
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:15004
- C:\Windows\System32\cmd.exe
  "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
  2⤵
  PID:13156
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:14440
- C:\Windows\System32\Winhost.exe
  "C:\Windows\System32\Winhost.exe"
  2⤵
  - Executes dropped EXE
  PID:5828
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588871584840947.txt"
    3⤵
    PID:14824
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5688
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588871874590994.txt"
    3⤵
    PID:2340
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15552
- - C:\Windows\System32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
    3⤵
    PID:15148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5964
- - C:\Windows\System32\Winhost.exe
    "C:\Windows\System32\Winhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:15100
  - - C:\Windows\System32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133588871584840947.txt"
      4⤵
      PID:4284
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:16100
  - - C:\Windows\System32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
      4⤵
      PID:3616
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:15176
  - - C:\Windows\System32\Winhost.exe
      "C:\Windows\System32\Winhost.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:408
    - - C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:18360
      - C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:17540
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:15500
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        8⤵
        Executes dropped EXE
        
        PID:15192
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:15668
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:11552
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6108
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        15⤵
        Executes dropped EXE
        
        PID:16412
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:16340
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        18⤵
        
        PID:7784
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        19⤵
        
        PID:16156
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5476
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        19⤵
        
        PID:15820
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        20⤵
        
        PID:15328
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:15680
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        20⤵
        
        PID:16396
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        21⤵
        
        PID:5472
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1508
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5380
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        23⤵
        Executes dropped EXE
        
        PID:19400
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:9708
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:15280
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:16044
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6500
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6340
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
        33⤵
        
        PID:5528
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        34⤵
        
        PID:8772
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
        34⤵
        
        PID:15764
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        35⤵
        
        PID:5592
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:16152
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5844
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        36⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:16364
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        37⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        38⤵
        
        PID:15648
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        39⤵
        
        PID:14948
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        39⤵
        
        PID:9164
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        40⤵
        
        PID:7380
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        39⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        40⤵
        
        PID:16376
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        41⤵
        
        PID:7444
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        40⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:16216
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        41⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:13952
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        42⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:16212
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        43⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        44⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:9068
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        45⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        47⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:17132
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        48⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:9324
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        49⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:19140
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        50⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:12696
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        51⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:8684
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        52⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:7148
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        53⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8060
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        54⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:16400
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:7748
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        56⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        57⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        58⤵
        Executes dropped EXE
        
        PID:7376
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        59⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1916
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        60⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:15888
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        61⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:7816
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        62⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:10732
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        63⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:17316
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        64⤵
        
        PID:17892
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        65⤵
        
        PID:3032
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        64⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        65⤵
        
        PID:18572
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        66⤵
        
        PID:9960
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        65⤵
        Checks computer location settings
        
        PID:18696
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        66⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:8388
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        67⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:18088
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        68⤵
        Drops file in System32 directory
        
        PID:17496
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        69⤵
        
        PID:19344
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        70⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:11828
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        71⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:19328
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        72⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:9644
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        73⤵
        Checks computer location settings
        
        PID:8900
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        74⤵
        Checks computer location settings
        
        PID:10020
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        75⤵
        
        PID:12416
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        76⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:11380
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        77⤵
        
        PID:13004
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        78⤵
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        79⤵
        
        PID:11696
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        80⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        81⤵
        Drops file in System32 directory
        
        PID:11004
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        82⤵
        Checks computer location settings
        
        PID:7828
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        83⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        84⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        85⤵
        Checks computer location settings
        
        PID:9808
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        86⤵
        Checks computer location settings
        
        PID:9624
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        87⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:19280
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        88⤵
        Checks computer location settings
        Drops file in System32 directory
        
        PID:9020
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        89⤵
        
        PID:9492
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        90⤵
        
        PID:13764
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        91⤵
        
        PID:10848
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        92⤵
        
        PID:11116
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        93⤵
        
        PID:9884
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        94⤵
        
        PID:9452
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        95⤵
        
        PID:10980
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        96⤵
        
        PID:10528
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        97⤵
        
        PID:11352
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        98⤵
        
        PID:10236
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        99⤵
        
        PID:4912
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        100⤵
        
        PID:11464
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        101⤵
        
        PID:4948
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        102⤵
        
        PID:9952
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        103⤵
        
        PID:18380
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        104⤵
        
        PID:10772
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        105⤵
        
        PID:9836
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        106⤵
        
        PID:14036
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        107⤵
        
        PID:1336
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        108⤵
        
        PID:13332
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\pkcs11.txt"
        109⤵
        
        PID:3688
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        110⤵
        
        PID:14748
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        109⤵
        
        PID:13388
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
        110⤵
        
        PID:14064
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        111⤵
        
        PID:16348
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        110⤵
        
        PID:14320
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        111⤵
        
        PID:18620
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        112⤵
        
        PID:17584
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        113⤵
        
        PID:12444
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        114⤵
        
        PID:18776
        
        C:\Windows\System32\Winhost.exe
        
        "C:\Windows\System32\Winhost.exe"
        115⤵
        
        PID:2980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:8176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" dir /b "
  2⤵
  PID:8592
- C:\Windows\System32\findstr.exe
  findstr test
  2⤵
  PID:9744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:12268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:15052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.0.1291845390\807286444" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2878814f-06a4-495e-a079-f13b54bf2e2c} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 1852 17339ef3b58 gpu
    3⤵
    PID:11900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.1.1662147441\1701304486" -parentBuildID 20230214051806 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {285bcc1d-5200-400f-8f90-68ab518e210a} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 2416 1732e28a258 socket
    3⤵
    PID:17488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.2.1636428764\746071203" -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 2984 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd51bb3d-9313-42b0-950e-ace4218d927d} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 3000 1733ddf6258 tab
    3⤵
    PID:12712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.3.1284369348\2063317638" -childID 2 -isForBrowser -prefsHandle 4220 -prefMapHandle 4212 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14435072-66ad-4878-bef8-53388d384fd4} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 4232 1733fe4ed58 tab
    3⤵
    PID:6804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.4.729560068\512173561" -childID 3 -isForBrowser -prefsHandle 4956 -prefMapHandle 4968 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cf0a507-3cb6-4e3a-94cc-e46c761e3c2e} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 4980 17342348058 tab
    3⤵
    PID:8804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.5.2070492773\1651619223" -childID 4 -isForBrowser -prefsHandle 4912 -prefMapHandle 5124 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7aac476-2416-4d42-b5d7-648696cce267} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 5112 17342348358 tab
    3⤵
    PID:16864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.6.104278396\1528159711" -childID 5 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dec67d56-1702-4adb-928a-59a75ef2a5b6} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 5304 17342527058 tab
    3⤵
    PID:14852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="15052.7.331039965\1444792161" -childID 6 -isForBrowser -prefsHandle 5760 -prefMapHandle 5836 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89deb979-6684-4008-a340-45a382b1dfe0} 15052 "\\.\pipe\gecko-crash-server-pipe.15052" 2856 1733fd19258 tab
    3⤵
    PID:18408

C:\Users\Admin\Downloads\MBSetup.exe
"C:\Users\Admin\Downloads\MBSetup.exe"
1⤵
PID:5240

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
PID:13156
- C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
  2⤵
  PID:12852
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
  2⤵
  PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:15056
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "000000000000014C" "Service-0x0-3e7$\Default" "000000000000015C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
  2⤵
  PID:9772

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
1⤵
PID:10560

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
1⤵
PID:13540
- C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
  2⤵
  PID:1096

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
1⤵
PID:7720
- C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
  2⤵
  PID:10000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Filesize
2.9MB

MD5
46f875f1fe3d6063b390e3a170c90e50

SHA1
62b901749a6e3964040f9af5ddb9a684936f6c30

SHA256
1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec

SHA512
fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

Filesize
288KB

MD5
be64d92ef42542680701e62f053fc0ee

SHA1
eff14a4b48f454d2d0d3f4e2f45dc1e63256a892

SHA256
b02dcec2210a1451b951844a77bc696200f26038d85b76317be11ddc7f403991

SHA512
4c3880669c6fdb8a1eb5a65dc975e256e9a306822989c7f384e258147d93f24f146584099b2417ff9a2035f257db9b3c31e40d7927a17d3f8e5dcb4ff8bf6166

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Filesize
621B

MD5
4264db74d58d3daa6948338aca275933

SHA1
1b50348e0ff57364f3069deb16d667a5661a42b4

SHA256
b25b3e8c282e7df53cf23af64a78fcf2bb0711f2f41d4ceaa71cf8e06a398919

SHA512
42904a35ee4a21c8066ba81a1d08e9855fddc14a0846725e18a61b5e3933e3451932b0a4521bc2c8b8b93dd79d20a11ce210da54146006c938cea488a674a0c7

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Filesize
654B

MD5
8e8f9fb10b58aef718c1a77150aabf24

SHA1
8b3d5c7e2f5a6448dc486d064da6e60d92251fff

SHA256
b2ec99926edf552aa78fe77d2f2580993b6dab9885aab6f72bcc0a48f03e453c

SHA512
c264f00477885ab1120da82b0e323bc3a00e9627a0bb1857a9c1c43107bb56892c582756cc75ec1eb2d1b3a343bd7e28d23c491e45180468ffe98ddd5e6660ee

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

Filesize
8B

MD5
c6476dc8d8a8023ce33a4d6b7e4d3c10

SHA1
766aab2a8436e191973ed79b92552bd9946315df

SHA256
1d028be3b632554c25bec8be9d6da971f175fb84c359bd764c858e6cf418f298

SHA512
c5788c4e145c9b6e619a964944758f951e0600af8e9542c78e84e5e2d0c41c0e7e090f541e532f965e3dacb3d5977d23023326fcc3422d9f47e11061607c6a3f

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe

Filesize
3.8MB

MD5
eaac9032a5151ea0d7b74ae4bab32b35

SHA1
f2c1f886868f6b9f78aeda8cf95df5051239c1ef

SHA256
807379fdd7315c29bc1e96ed224285ac5ae0226bdfa5318642eaed6bb0ca3191

SHA512
91fc6c387ee270372c401aa27aa399c5f6091dbcf1e94058c88e5edb473a7876c9de632cff5a4d6479a2a9bdcfb499c8ac6cdd3bd954b04db89685ccde0661db

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

Filesize
1KB

MD5
5d1917024b228efbeab3c696e663873e

SHA1
cec5e88c2481d323ec366c18024d61a117f01b21

SHA256
4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8

SHA512
14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

Filesize
9B

MD5
8f0064424889183ab99583b7cff79ccc

SHA1
670f5f87ef8aadb74707f2dbd1959f12719e04c5

SHA256
7439ef6606cbd8a2e94777098fd107cdc66ea97ca90afc48973d55eee37cfa76

SHA512
0bc445b13d58af34b877cba741ee5b308e9abd8e846452bc41be13397a4e58512ddd1bb658ceb27234588d1c7ab841cfb1c51b5b93efd917c51ecc469cf9c35e

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\version.dat

Filesize
47B

MD5
d652b51e9b8c2578f60c07fe1c2ddb21

SHA1
e4bbdf32976f57b6cc84568f8dfa57c1936ce722

SHA256
e8079157b2f4f6e48ffdca86bd2575fe6a3517e758c71160ae33b3f069ca9714

SHA512
7f375ade9dcc2c4c757b9ad616a645ea44a9a02efcce16531a9ca783941a08de8dea138585e8e0f41e55b851de1d8b21af40d287d098add5359c7326fb234186

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
1KB

MD5
a75043d7ef9db6c6937a86d07d32a863

SHA1
44d698d3ee2724614b306861e70ebd7a32aa57a7

SHA256
4d085423d77d17cf8ab7ec2f44944e31f58e9c5567d2e06b543a4fb69c425a04

SHA512
635c70b3a450c5e254e68bb0dff029306f85b4848a9628aeec34862f941496cd5221a74f853bb7ae199a62e2d4bd038c521a51f6b4156be8f224747e8103c640

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
47KB

MD5
7a2eb4116816b3810d6a2761d50faf57

SHA1
da519aa953e84b15e5c7e3beb8d0917fab82de7a

SHA256
239e612c4745aca537c3455cf073c71319a0241122b159230b7a0adc6616a5f0

SHA512
708f4f6c89c52266364e46be689b731ac23c305f647a548a8f50b2bea8a8bf093e78e15f95aae682f9c17387fdde28cfb1b54865ef8564e109ca5311317279e8

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
66KB

MD5
73fde551dde0b30fd1828e4cef45a0c5

SHA1
84367d4407abb4ebe978854bf6c0ea892bde291c

SHA256
3ad8c03475610074ede7baf432939b6651d9b4c829c5b2b2bf3aaeb9510f30d3

SHA512
073c16910043c50f0e2ee69aa60cad859f055c5775669934daa7bfb98df9204723c720bc449963ee422c1c997868f252bfdbd5bef05a585ef9470b6076fff8b1

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
66KB

MD5
f516748864ef29eb3edd33e2fd251832

SHA1
8b5d6205b1fff519d958869e1750daa0b7cf1809

SHA256
81a3da4619a570db1e3b2ef30a039bf6f6c7d234302bcb254797d4af23fd2e9a

SHA512
00944ec4b103a729bbb34ad1312bb1c2e7270e7d1d60a63e1326e6baee4a7b1133502ed717de20220494ec96f6177c4cb0c3ca6158e9d22ad0a1b5a5ce51c50a

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

Filesize
607B

MD5
b6315f0ce6ea59af819952d8a5c69fa2

SHA1
c73b6843135f4ce2817ff06cf507606f4b6681c4

SHA256
fee714f89eba53c5b1184a28bf87fecc42a2efb6a298a2821e41d90157209e75

SHA512
1eaa8bd4a69dc9b600fb05d6dc3676f3b5851773b16631449aa90fd95e205e6a546d45c1ce30d4080c1fba22ca751882e5b209bf52a0f7453fe64b0b6a61ccd6

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

Filesize
1KB

MD5
c0bd0ce2b0412dc332f10f572c041222

SHA1
581a77c9a5c185513e151f0cb7b984efb8a22a4d

SHA256
0c18af55de1254d9c4d6f207fdae2fbd57c9db43be3327480039aae48cf046c4

SHA512
8c7be3df7a261fbf9063ea862c06be914254df3abb2489aeb7ee89eb377bf0aafe63031688b26be499621811aa70e080fa8d0eaa43684ee8a28a86886440bbb0

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
2KB

MD5
2782f7e5e4fa18168e530ebca66eedb5

SHA1
f3c670f1cb8bda19af0f7d7f241ae7af073e08ad

SHA256
148bbe622e6780925ea8dfd3dd5dfd83e0a1db9ab29bfb1891616b2007cd1094

SHA512
76f691e0756deacc0379bf5a1c1d2bf2f362dd889c4108fd1f07d5a8338c0d091b8674c29f4f78ceae1754cc4b612a7d56812355b4d4b9c806a219cabfd2deae

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json.bak

Filesize
4KB

MD5
7579e79cdb50128bffa92cf11ee74425

SHA1
bd893da77c0a2265b2393dc3d885645bde1eabe4

SHA256
f33d0e415978487d36bfe5b3857cadce2b5e1f115d7958924bb34fff6b9d0f65

SHA512
2081d236a1eafd2d835584a490e5499fdd84db016790db4c67d86ce001625456ef307f38b360a3ca9dca8f5f061a8cf9b0ab81980a8f19cea5df57f8cb591ac4

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

Filesize
11KB

MD5
911838ff25cea6f38e06a9285e0581e2

SHA1
1c377995367ab5be4b30e7a2ceace92f414e8576

SHA256
8d6a414c06c4ae62521684ce1d6f13daacefc66c1938ea6da5eddd3c3114ffbc

SHA512
2863125d8cc6d5153a22dc675a2afaf08f351862e6c8de70528d089f2e8d8e2b8a17dfd1b9ad519f15a9d580dfb7078d7c440ffb6be91bbe64ead3eb65a0119d

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

Filesize
1KB

MD5
74358c87f6a7bb2325ed32ea33997d9f

SHA1
21bc6dc206ce5054831c12b2544e2166cf7d38a6

SHA256
d1a0c7db90d57ddda2cee8a24663a9925868672e4d68f3dfb0433bec5d71ca85

SHA512
d59edcd8d9b9785ad5167e871f962d8c231f8d2255156e49cb1b6093db548b7461db7c20795906d84042781087700414c7e7aac97b1563c485ba4f1daf843e14

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json

Filesize
125B

MD5
4da9c97d8307104516ded7eace7e0acc

SHA1
1bd39d981d2195de44e5b50063fd06ee78c8c769

SHA256
e72390ee92c93099a1e79de7d7845ec3162d391ad5f947ce8e0483988222cfe7

SHA512
c5e7b0d65bf9f389a439f3b765e2dc404aba40caea142210f426fc813533ba8a215bda48e0fda41841f822dec4f7eefd12411b5d35e8261645fd55469d769f20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.420

Filesize
16B

MD5
2ee3544569ffae63f017b24366cce5ce

SHA1
781f02d06324c88e666f75e457052de7bca1a820

SHA256
520e42a1dfaf45b525423d434bce4bdf8d4d23edce6a964992743eb3006b276b

SHA512
1480c3751ec805c3a0994cbfcf9e7b726ad0ef14da35513a39b3cba0aa048266b67592564baad2af52ae18e2eddcf98fe1cd6354be3b1452ae2a6a7d0a0af57c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420

Filesize
16B

MD5
072c654c35c4f59373a29a87ea3e6e7b

SHA1
89484dafc78b27de3ad97432b620301487d07bd9

SHA256
347591742d14fa04f1a1554500906fff9006158216a30eb905ddf84fea591bc7

SHA512
978e1e1dcbbc2351beba9188f052d3678574b5151328d34d5c32d68e47ecff6c1baf8a530917c087793cf8dcef68481a890f8f1acaa4285879197328e0c8989b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.420

Filesize
2KB

MD5
79c6d2f86802a292f41fa3c385f61fae

SHA1
c64a66a9a2f645bcb309ea9d10813f557a05294f

SHA256
5910fcb4482dd12e202860f1fc72fa144aa27b390fa275901092f9214398fe9d

SHA512
cbe4311403e3bdc10e33ca0ff2d8a380346769a01a9cddfce292eb5da3ef506a47570f301868acc7bf4e52b1a483dc984b9f35bdfbaea976f3da388e099bc6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420

Filesize
6KB

MD5
183b3c85aa000cdfdd600830a42197e9

SHA1
2ea6c0258a77362734e23ac491c5b555e2e96abc

SHA256
2f21b064a61ff9a6420e44847539f5d68a93a9122bcf9b5c0b1ea85a9a866a89

SHA512
d7a924d9a987f7780a35fe51478d1b6343e57e53cb3eb0d7d22699804cb49ac70664e9d5b6cd7101fb16978fb1fbfd76fecc59c53122747a3174621cdf62a902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.420

Filesize
321KB

MD5
585002fd4d920042c3df96a55b15265e

SHA1
8a3460d110c788735ee5318452be9d66e26cf803

SHA256
012a9ca399cafc89ce6de583f6759e283aaa6ace0ba18b879a70e67c71cd28d1

SHA512
5fdf32a7e064818cc8d3ce3dc3f12c11766630f76d58f93e7b0f44e093175cc2e584d34f05b85ac13747a1db297fe1e4de59333caa8daefd1900abfc43842d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml.420

Filesize
560B

MD5
ce7a2191490b33f6635bf3172acee6d8

SHA1
f02feff3160bca6d14b7169de2cb713c2310630b

SHA256
b9166a5fb3af0a1ca977221e0cd131e4c33a6bfb7e48bdde79822e9d69592784

SHA512
c801dacde4163bdf7ed6c21eb13e5acf2a7ce71b3f6f5a003e58f8580f2651b7adc543a3e680da9183262a1cb87bb796762b8ae86a1c8637cddd1f937f5231ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml.420

Filesize
100KB

MD5
6df18ce09245971e338740f870084394

SHA1
a40043b2edff084d0524361d9854440eec48dede

SHA256
c5da6142ec5f836293652b73c9bf8fd91847c35f16cb5956e188ec6a7b1c0315

SHA512
f345482afaf6130cef932814a0dd957fb0c7ddf88190f634c911c4eb909a9f8032cf834ae898875a5f7a61df7a5669602cf1a426145e6a1902433477d86eeec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.420

Filesize
130KB

MD5
971626d372e843e06a467e87531980b7

SHA1
afc29ec325c6cffe180db538f1ea37f084b5cc07

SHA256
4869597258a3ae224079a5ff5d841113e544af2403c4911e9c1776d811ba149c

SHA512
796f07f0e93ce9deebe926f6d24f843cf572a0fcf14e156629768d612cb01964fac9cd258e992894556c8bef13c63f0f19de88aa8ccdd6896b45045c66459413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.420

Filesize
270KB

MD5
85146fe4b4856a1b57a6172c66bbd2c9

SHA1
6c9bffc717198baad4466b6ac7faf1588de5118e

SHA256
8666046bf445502116e8b34da531e987589159616ddd727fc4623c8f3f0f2fea

SHA512
42561081193f7720810936336fd3dddd1e08e2ca6ae39751f124a8798282eb7972f42acffac320d5d6adec84b747de2ce86117b7117e9675d2338acd2f5667ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.420

Filesize
332KB

MD5
a2ec35656944eafa1336bfe5f098a06e

SHA1
8de63e27e9e3a9a5c02b3b9e92d024f78ca1c68e

SHA256
5a06a1372e9a993eb5ddfb7be5359c018d5aecf6fb99298dd60d111d90501f19

SHA512
f259ffc7f1ae145db87e7a93c2b6c05a800b1869dca41a229bb575d36cc51db5592a1e335c6712204ff56c7f22833b264c0dd5ac147bc2cc7c93d595dcd04401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.420

Filesize
5KB

MD5
7ddfa22afa17b213b92a2d706cedb7d4

SHA1
3ce6e66634953a4676609f17dd7c917288151cb7

SHA256
568c811db6c7f33dce5723a3e73934cf7639f6fbffa43f2699ecc471953d083a

SHA512
119b92a454857cedb6707217f2f59d886ba075b5585616343c86708bf78a6e299a34b7d1a66471feaddeb970197be5a0a0cc273044762c69eae1331b1acf5860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.420

Filesize
7KB

MD5
af406b2f60e1bdc11f38941d4c8ee789

SHA1
c2a5e8544d6d052f31d4be12b56bcc79c7075228

SHA256
f2f3321fae628993beeb9510f3413887be214dd23d438c59ee4fc04ce5577e19

SHA512
06d53eb7a72a654613e6d6c950664fe6dee076f14fa5bf454bceb658e5c02c00f183d82374587e9c3bddac9a7c224db047fbccd51551a29e18feef59e753c492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.420

Filesize
8KB

MD5
20212b619de20ca8036bcfa143b448a5

SHA1
257258f87b8b35b6269a59f62832d91e978dcda8

SHA256
56567fdd908eb6c58aecf155741eca281ab127131056baba63c25b5882160180

SHA512
e427ae838380b97dd33d4bdd507bacac8788aabd095223d5f73b4ccd341d10aca6eb9b9b1da51adb78666cfe3746e5847e71103464bbc9b55c802777f14593da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.420

Filesize
2KB

MD5
117b11840457bb459a7de042aeaf905c

SHA1
e8ea99d0a748a512e3a6d8b8a3954ec2dfb9f549

SHA256
c82ceb7025d365cb99c623060b4676c4b8c61393818ff5cf48ae51dc5dee4dd5

SHA512
20a3d7c86d4d5388c4a6a2d91067b3d7484e5506422747e77237ad31f53f8af407919f12468975402a9fba1d91e0c2f03f316a2b2224d87e56e87facfb022165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.420

Filesize
10KB

MD5
3bc42eb1eccdfafa617b61474724dac2

SHA1
6a26940a2e23be374d418ec2ec606b50f84bb0a5

SHA256
88cd551ed0c80aea22a7cc6bfb3bf7dcb9f49abc7b7bff007f7532157f1298c1

SHA512
08a12861bb2320022298b5f1707f245671ce8a46766b4700f47a66d6bbeab79285d156ecd6fb32058ebecaf5b8a52691f4a6801177bfc3867f865130e5a2d678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.420

Filesize
7KB

MD5
79aa301d332168d9ecfba9705dc6f18f

SHA1
f47eb9382e85cf252f7ba4fcaa983e71d9031097

SHA256
90662bf8645df521077b9de4fbb61b355791f2b7638d0250b6b0b21c3b5d418b

SHA512
2819fdb2dd5851bb19455176ef6016ae44789552632cda589ad07c89d54f1c8b91f00f0c060ba83b64946b8973463441eb60f82835d2f4b95ac22a5d2dfc6e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.420

Filesize
4KB

MD5
3dff36784bd6d115206129782508df22

SHA1
b84b2cd5fa681000cfe543e09e0cd1af0e0e2645

SHA256
2a43eb1ff6700e2111e4737de83ea2af08c9bd2369dbd3253cfd6c2b7d0db60b

SHA512
5c5e2378920f60f91f5f512c04ef63f5b056c03a90be965bcd5c293d7f9b39c9d292ff9f8e037f8aef98d3ceaa7d8bf5545d23713fd24076c2eecf2823ea76df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.420

Filesize
7KB

MD5
6482ceacd5de556c906e9174ea213ac4

SHA1
9656e3a8e1315f109c3f4cc4d7df5427919ed736

SHA256
8d789177af9a428e3e035d4b574983aa577d227f341b12800d0a4dfebc20c84a

SHA512
8c7dd9b2fd53b38b20f38a1cd79d1c7d63c93f6d50fa12b81856cced8ddba7b840e50dc44a927d56f7553e5b6436d352abfedf5b885328ab65af8992781d8d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html.420

Filesize
6KB

MD5
a3a2e4e16aaaa6cca6e15f9c90eb7dfe

SHA1
54e9f7ad2b8e11526c7006dffe24cb2376d546ba

SHA256
5ba1dbcb7f628236eb28138e59539ab100dcb9c6c8dc58970780edc8deee4e6e

SHA512
830788686f299d92dddb14c23b5fe3161d438362a7a235ef74ae3fb6cf6043bf39ecc91cbd4f28c605198b8982326ba38f975f525b4375ed146c8acc642e1b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.420

Filesize
14KB

MD5
c7a6875d4b6bd830b490da8514d4ac8c

SHA1
5cf2cb12dd45468f56c07fdda90066982bb21a41

SHA256
5d0cb829307b1ac8ed6ce598bfdc25a10bcf31fa253d78ff65576472e21c7aa8

SHA512
245b0a07e81f2bab9ea6dad29629059e54d83940dbf90b1caec564733c29230380e25e87f06f48da04ff653236fa46dc168bb6bc65a96e8b20663e432f5f84a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.420

Filesize
10KB

MD5
ae81ade97d2022bc559f821233eaf251

SHA1
4d2db669aed5219ebd52b0275dfcbee823364006

SHA256
51ef1bccb57ec7f93b6e4e6aaca6234b3d2e1fa7c88af2e3b24b7635bf73ff3b

SHA512
a662848e8eb903f3183c4e6c8d72f7200c6cdbd284c7427652d7ea786de624d330e542ecc0965d9988a1e0dd32756208119ecd3d709ddb6be4f75f1b5451f561

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.420

Filesize
10KB

MD5
f5d45c66151be312d7930f8dd76d263c

SHA1
39607f30eab1acb130a6f3bc33826dadc791a3d2

SHA256
886066767cd98f0571bf04e7028232c05e670ba855de71fa9f29c5d217a96bd8

SHA512
719ed3b7fcea5153beb0c7b310b39f249a2b6e043e24bc501435478f5e5fff37b65d0787aad72de377fcfd6ee7f783154ea53da48e513b6d7add850c83d4c492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.420

Filesize
4KB

MD5
2137052f3a4740453eef134d833fe515

SHA1
899afc8803980257f87f68fce70526f44e4681cf

SHA256
b9f30902704f6f64d5f9677182f9021a43e57a03bf72729bcb4d7b4e59f902d2

SHA512
8f39d8c36087f04695360cc7321ed275ef2df6dfa5d5d139551e0096dd4659058165db778d936cfe81e2ee6cf42d672efadf664d0840617c7cc11c42c493463f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.420

Filesize
8KB

MD5
5ac6e918f45de88df57be721161ea6b0

SHA1
99a9798c124b034be5c62013d6b0ca141d1d3562

SHA256
76a0f92020287fd0c32485b054fd08ab0bf8248f3fe3ec7b50455b22ab67ea05

SHA512
932321e9768b216971ec621a2fa884351cca2baef5226e0b5747d0709b851ed09ba3f2d33306a1cd2deb9f4ce4b33227f36bc16468668b7c71b632a974a44c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.420

Filesize
9KB

MD5
3add9f876b690d3d8e2960d9a9c94a5b

SHA1
e8c47cc3c90b5ab817be43aedfff0fbbe4011f62

SHA256
cc7ed7956b82eca55f9c4baaf1e4b37bfce9397b859edea361f1b9c3903a6ae8

SHA512
44a4804b2147d40e82b2d408354a0fa733744119e4beb8cca5366a604db87b48fd3a92e1ffdf15664d6dac14b1110af5e1b7df496d54b7c42d8d262ac67b8385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.420

Filesize
7KB

MD5
072f453a89a4d3038e6cbd578a6321c0

SHA1
9441cd7523057c477a1968b7a91fb9dd21194820

SHA256
681b66383128c1a3ac22997173fce26ff2de8ba5b809e5f960b8a680767b56a3

SHA512
faa4fa5355d6c1346a48f79d3b12bd9f993d9df404ed11c31fc007eb482797a4acd6393a306685beef1519dc0724af187ca81eae4bae3fa00d1dc363cdff2040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html.420

Filesize
1KB

MD5
50f45ddb88b60bc37c52c35948da6226

SHA1
20e39190857e0247db2cdf7d2e55b438f09e0397

SHA256
7cbcfe19dc39c2883117b0372707f79b083d98bcbd0dd99e45d3821125a09646

SHA512
e2e9c3486bedf3e0ccef99856ebdfaf7226e5a47004ea129bda2df66ee0d29ce9bf520d8097cd6b7b7923497298a4a4f0abb623b7905f89408e4014d4c6e8c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.420

Filesize
47KB

MD5
2bbffea67fd3664e3428d14f1b21ae9f

SHA1
0c324e5ff82f8a1e5b3e70597f71c263cbb07b6c

SHA256
89e64f11995f8f665bc064c907d33fb86cba32653ba256ed847a51bf89a91c30

SHA512
45eb9dce53dc40117dd5c38aeb1c8e4ad3bde1f7a1bac5e2e38e708cdbb09576ead26cdd807b21bb820b9a5df11901a3e615cf76946c03a0cf16ef3b734a7346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.420

Filesize
2KB

MD5
65213d2df4e3bc35bcb0e2085d1546ba

SHA1
4d7721f81ff9097a76698f92e1a5656dd226c9a5

SHA256
fb446df7daca5f6615250fe0873de17ab96b2d668f21959e0a57e5ed56f10280

SHA512
5099c07b3db82f3d371c585307b0060fd63e93769d6714f1ae72ace9639c3bec328d270ac9e6d644e4c404ad128d1bcc5dadbb835c6421be491186bc20b1fb7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.420

Filesize
720B

MD5
7292c68b20c58e9c78acb05ca8c9d56e

SHA1
e01722906f89a7a3a728c8c385ac9d306bc485ad

SHA256
14cf318ff227a7a73e5441eb91cd513fe134714b58a8b1863495f3abe4ab2f71

SHA512
95c0da6794cee8c658d1f9bed5b303e2b4f861c979b598f69876bd57ddc2e31fd03996ceed01253783bf5f4d8c9fbe303514844633c14f2286f083781099b425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.420

Filesize
864B

MD5
1c58bf2b6fef0f0adabc8525584ffa1d

SHA1
3a32959040b3527078de824bdc16161d64949f17

SHA256
5b478d42e551d6185f46cdc7c2b06b0a647b41c9f10e3ee374556fe0f9216da2

SHA512
953f108fd4de1e7d1723ea4f16aeba03d46eb03c0871b4e8635362006af41ff0a024083a80ebbeaceae5a681455beeb8b33881d6bc459aa1ea087a807ad41fa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.420

Filesize
1KB

MD5
7738095d6f7a265d783fbe963094d5b9

SHA1
520782fcc3f82a1f781502af95fcc96e24c3680a

SHA256
a016c9c5d952228e0c68ea9be6aea5c513f35f9a2c728639ca49ecf91a89ef32

SHA512
1e612071afac4b13c388ad73a7111e813a9d86a41d8d51580678301bce82a51a9039d7448abee408fe24870b3adcb484751afa6120e48391d80af2dfe3cc04ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.420

Filesize
672B

MD5
9f2e878913de5bff04dfd1dd8ddb6b3b

SHA1
e74011551ae3f123fd2eb5e66647b6072da72e92

SHA256
3c6ac633b8bc9e6b89157274c1648a9dbf33a9095ec7ded4394cca7b5a65d29f

SHA512
ad3e91a784ad7449e47f90eedd18da65fed6807232b9ee05c89e831a0a9bda2fedb7f48ea68fd9e756a4ecdb866c275612ea2c67ada16d3c79efc83598aa71f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.420

Filesize
880B

MD5
5bd745aea264e813f912c2bd0252e62b

SHA1
8c8b6864e33f1da7143e59105eb998fcac0f1f9a

SHA256
66d31d56a6cb5f029874dd61f50f36f76f6bfa66ccf3a29e1ad24ba08fa3a964

SHA512
f2a90c1e2ae5d58366726cca2da2334f1490f465dd964c8091eba544a298374eccb57a989c518aaa0a2642d3459d8cc685f819fba052f38a9a8a5b1f1b038937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.420

Filesize
816B

MD5
24ebc50ecbcd6bd5670b2350add1462e

SHA1
8c9552c44ac46ffcba1e6fbce839b542428fdd51

SHA256
de209aa977927a0cd8507d4d8a776fded8c690b82cceef338cfdb708fb85d24d

SHA512
f75a19137f81cf51d2ba01ca13a0ea27cdcc281821d5ed4626949ff0e11c1ef6f5a52aa6e3404bf14cba766fb9335a448c03c08987db8f668ab3e81d1d8fd09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.420

Filesize
1KB

MD5
b57ec3a89c6726bc15e1dc35826f6578

SHA1
1f6f531db4b88e294bc3289fc7596edd7121a5c1

SHA256
20502faa3bfa98955786c303974aadba89cc512d4ccc39d92df7a135da11a1a1

SHA512
ac01200b80cf80be4fe3349c30660a813d54a9c61631d4fb73942cef3e0c708434591bdf12390decd13b9fa15173db08be7252733eda40b10181725910ac70cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.420

Filesize
3KB

MD5
6cf9e15ec355952ab508245ed98676d6

SHA1
32634a4d1966b7600934adaefa5f197236b81600

SHA256
75ba529ff811da0eb8164b790bde9c91df14df3128f65d7a94857fbc2b02a180

SHA512
c0c8cdcb90387f87eaea40b682bb9e54430afc3ca917d7292ce1e3127e8538d0c92ce96b38f447deda30aaaebd4b5f653457de8ae35666cb05defb361b1f53d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png.420

Filesize
656B

MD5
236cd2abd158f2bd276dc0f8d91e8ab6

SHA1
793fad5583aaf119c46c3683cf139a19e87341cc

SHA256
530afdda1fd2319112eb9a2695c8ade5830519d9999fc8fb1bb9c556b483ad33

SHA512
c2028106029196b4665be0ed9a5662453ed7ab4d91f34d4e6f527b84cdbc8245f7516f128055d17ba62928953a48bd4fc2d21b6a9177fbc53087b180f08f7310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.420

Filesize
992B

MD5
c455efbd6bf02c728bd34fc5609f24e1

SHA1
a0c67cb44a5bb33de333221b771058fc163d9a52

SHA256
cd770dfeb9dad9c406e163381448e6628bcbf3aab3614c4083f2a50cd767c0cc

SHA512
644edb71ff2ec0bc5d983cc907484f167931c0e591dce7ebc3cf74220bbb551f280e6d7bf732ac25b517b3ad929cdba5a8930eb01bffaeb71bff12157b58733c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.420

Filesize
3KB

MD5
755de4fffcc51b6c3a30bed550da85ed

SHA1
d46ba3e3e4d96470dc2821956ee0ea8de3c62fa7

SHA256
48ccdd744a8d844b30519df4c44f0f2feb8225737cf359946caf4c7b4cb3b7a4

SHA512
9eeb945e25a9fc1d6b1f3beb3fe899534b6d2697c2b4666f8702562273644822d622d8e6bd6d8b11382857d62b2314513f1adca76b7af2b43ee5c3f88184a77b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.420

Filesize
416B

MD5
58a51a59ac81f45b8236a77f17794537

SHA1
459088c0becf03c86e8a55006911815339f4747a

SHA256
ba115c59d79444dc7493bde8a967e97eabfcfb4060114c0bf9df75fc2935bac0

SHA512
5f95b80eb58476d905f3b7bde41e95d97b33c2da4318bcfe5622710e7d9bb698048d6a03fd944dcab3a014b7dcb00e1f16cd1f9b1d04f9ccf30a1ae4563f4d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.420

Filesize
528B

MD5
cf5053be384f13da0be8137420601a41

SHA1
0e3c7aa31976d39022a44cae57da29932590a68f

SHA256
af84ffbbe2f21880d0ecfbda3a9a2c55ebb1c18fc684beef2c454ef7241e9b87

SHA512
5461e02261429f2da6ec8941839fa0aba6b5a4873c1b946ec8639512dc34b74910efdc96c832d340d1d93e379313faec1be2b3686f75d21bb2555a40477e7cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420

Filesize
352B

MD5
83930b510ce271650edd8d5e457fd006

SHA1
9b4a2f832b345311ecd0cc5aa073f4992db964b8

SHA256
ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3

SHA512
b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
1c728a5d22b3be6c72e0c947f974bc6c

SHA1
0ea528bbc86222a5b713cc7f29f471efd7339b1a

SHA256
8d38e68228c97547fb435131e724a1d8a26c5955e529c5d77c37031bc7b5eeea

SHA512
c9d793addfad34cf1df4ec1a771a1613a8a7968e26a63c55d1c5ee50d05ae051f7803007dc481a9a510af54089d87fe121cc6aab94c5b88b130b3cdd551817e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
d45f1dd5070ff4b87c87eb738a6f5b8a

SHA1
56f53ad96f55d01b095e519ccb29c6e460afb677

SHA256
796839ee4e05ff7cf03a6f050b3ef982b33f4a43dde13b7e1a2a1b0ec93d7a02

SHA512
1fc03ab72fa75010c728f8bccca67c91573381b4b24e3c0d1f3cc4877295f46f2b79ea73f9fa0769f314dc8b7079a647a54e6e3657616e54ec9d601b17f2ec29

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\doomed\18487

Filesize
7KB

MD5
e89610cd580c1eb7eb5c9115689c09d1

SHA1
ce462894940c337cf2f27a0d0bf0a82ff201796a

SHA256
d752c1ef3a937e713963e11d78759283804e5bb2d6a86bb23c61369c273a7a8e

SHA512
b1e0697552670a2793ca92314344426d755e6894a3c9c88a5482a6748da32b5693338529dfb2c1c2583eda8cc3101ae21bd6b9c7f48a8de66a902bf157b8942a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\doomed\18557

Filesize
8KB

MD5
952cad54f574d7d27cc389d712ee5006

SHA1
1fa4f3ab961d16ac715bab14940c9c36a7a68285

SHA256
49898f221e30a3954fdc0b672d6128f05445bdb2f9fff96e98a8176170b7fb8d

SHA512
ca9261a3cec9b768bc30f21bb4015fb6fdf3cc8b989c357fe733c6983896c258b43c654736cfd452ebb7ba159abe43a48885d941de73bd0b5ccbd669522bed33

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\doomed\8860

Filesize
45KB

MD5
1eb2abc6cbcf944dc6bb4e4fc2b2648d

SHA1
2c9046b77e23b8eb9c454728fb54dd140f1176ff

SHA256
ded3156f9cef7a1c0245a9d990535be5b03c11ed8d052af432ec45449f02b5d7

SHA512
56651ea278b2e84a000c1b0c93acd29c942f7d4b4caaaad8a350fc7a9631ff28601379d0d221b168f3e1be1884362eb3417b68ce7602a8f82ac89900cf5f6b16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\doomed\9445

Filesize
7KB

MD5
2f7f007144fa509e717162287c0e174f

SHA1
612d9566cb2e3db1d6c9b6d4e740263f86327e1f

SHA256
94568bdd41cf0836f0c89e0bef34caaa573946a215598fe2720a3cd64ccd76e4

SHA512
2a1e94bac8330f5a937fc456c936893e10f5eef7e23d57861cff652371e34af6288d6951bb43b2399e6e277751ad8e99253250421225c2e440afdbedaae2149a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
f90affe768416334493a84191c9bf765

SHA1
33d9a54953c3e2dcd16404bb60f7e3bd6263bf73

SHA256
749fbe05b5556603283bcd447307b9e4e48e30c475281b743eea1a89f7fe819e

SHA512
d768344cbfdf1b6409ebcf7419aea9b65dda65eae920b86ce4f16ad97b47a5f007dcf91248de9bb36d6dfd286bf807f1058cdbaa2b042e96426a1ba6babc13b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a071ad59-d4f9-4b90-809d-9a64b4020cd6}\0.1.filtertrie.intermediate.txt.420

Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a071ad59-d4f9-4b90-809d-9a64b4020cd6}\0.2.filtertrie.intermediate.txt.420

Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086821031652.txt.420

Filesize
77KB

MD5
bd95b5733ec1a8af34bdf4c54db542d3

SHA1
a0a4f888cac0c097c786c00d3c880ae4f2033b15

SHA256
a6e2fb8d0702267ba92313523e05549f9e066b88f686e33c274ec0a27596d2e3

SHA512
bd5a1de57875107b982c05413a41fc6f5a10d8ee1dac11d3fd63cf78b55f1ff5d626035e41fc3b26d73cfef9d739d6d819e85dcfbd6d6c9945a616d666733200

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092380013040.txt.420

Filesize
48KB

MD5
d2d98991640f351111e835d43a2aa274

SHA1
e16657b9474a518cf5e2cc6b2bc1c52763a54f2b

SHA256
5ad85386a3c6dc1cf4c48ddca9151b221d2673f79c2fb3e12fa93042dded0e36

SHA512
75f2a271f29ad3cd9681e1cf773ed469dfe19194bd9f40837897e2fffe45579b132b9f114aa55d5fd42df15a8937a00e92e3fad7257ad408a162e7eb785a39f1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095412638284.txt.420

Filesize
66KB

MD5
49decfe81666667c457426ab0aaef75f

SHA1
acc34ab1529ea7dd693f03363c142bdef769a7cd

SHA256
a43dba137e9a0e50daf794f7b2969acd3dd4232f05736aa7112ef57b86216de4

SHA512
bd0dd2daf63f9deddca74b6ee2f36c54efe05f920a33af26b14609850e87f9743169c6f7f5552bd38a3bc5257a29b5fe16950bba31ec1f62d56c5fff3ec5b302

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096013397188.txt.420

Filesize
75KB

MD5
c8f6b19bf2ee0ff2832e454bf06591d8

SHA1
a8ea462392e15401977886b156e3b908696f8817

SHA256
4b3f402852c0067a0c0e0b7c26f1d36808f0f0d8a746297064d8624f1865b2be

SHA512
be49d49e6e08c6f805b2ed86ecec05a7dd3b0da882e6523a162f6d588a94521af803b9b2b8a6c2472177a1adbb7289d726f5997159a79a9b7446dfe9843a3fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135659.txt.420

Filesize
16B

MD5
bea21141aa401823a718b5744650822b

SHA1
bbe9cee4379b81dcf6fdf92aff28f2209563ce50

SHA256
57535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe

SHA512
281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124305829.html.420

Filesize
93KB

MD5
19fc42bcfcb38aa7717dcae244dbe71a

SHA1
d5beb0e3fa6a1fd8b23b9e0c9301df01b6df94d7

SHA256
b56e1ebdca019b851d1f9acbd8e43c756f7ab48709c745c565bdcdaffc321845

SHA512
957495df2d32bd59ff980ac8af49910d316aa9f4945198277adc379f2c1aad73a5623b5e0b03044f0ffb4d5360e07bafa202c7db1e0f3695f6d7c0c0ac294438

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c23nlw3o.skn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420

Filesize
1KB

MD5
77f51f4039af2727912029a9e1defef9

SHA1
f5749d7a74dfff95bc969f27ee2ac2da2a70ec69

SHA256
a0d8678fb549eac36eb1d24d6fe21578e29ceddef0dc4549866fc331d3a2f74b

SHA512
ff94ae1c600681d5c27ba6fd107d1cc9899ef4363840f0c75e3b03118f56ed62ab0aead02ca1b784262fa517672c172822f9aa0bc35baa2409872ed5f11e3e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI478B.txt.420

Filesize
425KB

MD5
5fedad3d305fa87871687dd635ce2fa4

SHA1
facd037020e2906134b10728f3cc72765f33a975

SHA256
3757a1c2b03fb7d5349dc6d2bbb38ab6d7671747ab3e62b5cec055a326259305

SHA512
3c7b66ee30d6add97361e13eb241d3991b83a0a392823ad5c98b23091025aa83bbf7e65cfabd5988a71ba9b463326c629978245022504795f6ffa5b1aa602094

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI47AF.txt.420

Filesize
415KB

MD5
a5415c7b45443c3b0789a5ca47d843f2

SHA1
5625f1baaca452be6691bf307e209f26345c26a6

SHA256
f86c7ef54c6b21b4e4e603e7e4185d6577fe3cbe4f3421c75e7d6d7726af5b9f

SHA512
f02b857b26d88dab63e11f8ea5590863fc0ccb88bd1640116c50b71a2dc30a7342679f0fdfc1ceb2d5b50ffb1ad13c1aa094bb4fa1eb3f7fc453527720972a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI478B.txt.420

Filesize
11KB

MD5
8b0e9cd757b1edca8e8996c2b3d14cc8

SHA1
a54248e8ea0bf32c608a0e3f8b8ad25454978907

SHA256
43ea46ff52aa4bb656ef5fe7a8a1334145ea547b378733df0c2eca47609b6c57

SHA512
e75d5a6e3df9ee315122e0b6d00ef224250cb631216189641b40cb1a56c76212cb0921467db1b9a63f0ce6389e4e075d7920ec8e25a5d238fdab9027de5092d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI47AF.txt.420

Filesize
11KB

MD5
9c7acc5c779c6f3f08d63d785d00db7b

SHA1
4c41bed6424b7a3d99ef5359e783f7cfae7acb17

SHA256
534b479702a893273a852ee43cfc8b63b494e50eeaf451f756b6bc553b771575

SHA512
4a54addc8e69432d68da3e313d0e143e6e4f244ef72f25b244ce7cb2e1d94be438748444c4ef56768aa16ca376260b3f62f1a6805f5c8bfccdfb76ce444d68ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420

Filesize
16B

MD5
65e115805f15f9cda5eb01e8f742d121

SHA1
e3ecf29bfa71ce07baf8d02009afb8766f35981b

SHA256
7852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a

SHA512
dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420

Filesize
129KB

MD5
4524a1142015665150d7578bea56fd75

SHA1
311e4f74c4661fd68f343fec8a6d778e37567554

SHA256
a14b4ae3238a797e4b63140a93344f8ff957ceb1e59aa8764c756c16d938adf3

SHA512
8426df6e53a5749c131381cec2dd767c54e895656fce04d08db2ca5f49d41a853295ff9c01d73c7a29fb5f3830d0978abbd87854bcc0e8a1fc7955544ce063b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

Filesize
9KB

MD5
9fd33e9fc2a151ab01acb1d41827f947

SHA1
3002ee9b7a6d5e675211ba2221843fe073dbac66

SHA256
6949515ddd4ea1df047ff707f764ddd2878c5b3300c00fb631eb71bc225df2b5

SHA512
050f91e13172e5b922c91e73e57d877ee5e48816201c1f2c7ec8c0368c02578ccea6f065f021d69284ea576ab785d18a036e8384c1151af9f3b23e57428f333d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

Filesize
7KB

MD5
27f9b2a08066de2e2d77a5f599e290a5

SHA1
66e85c37c9d7e6b7c9ae2d0e8dfdb275ca8bfd1d

SHA256
f25c2e258762e44718dbbef998256d6ccfaaf626fcd084f7592a050090eff5d7

SHA512
28e3e3e6e49d09272758c9ccea02ea9aac8ad090fc86e2e57504e8d69390a2b124fe1e43ad73335f2c192834f50f5d659d107a48bb79ba08ae31120d0e08a734

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

Filesize
6KB

MD5
b09e30a3c3c222c85ad6d51d5fa85571

SHA1
d418681b1763b6c71201cfad36e7438c08a7e6f0

SHA256
2452d1efdb8930683cd0c6b72f470892697beab60bb54cd11e50e6eb04c8a4be

SHA512
12ae9b13ebbec0a95a55b56bf83f1150aa8f85a0ffe63da5280eeebc4f9aef52229e7ac1ff9ef49958a84a7e72bb3a44b72193f2312dd061c742809adde1d4c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

Filesize
10KB

MD5
aa7555e79563e58beeff810b5ce72a4e

SHA1
92dda81a18d9d3dc62832a7f64ce64c00bab21c0

SHA256
dc128a7058082f7facde8129d190c5ec92416d5f345e314cc4ea2b9c52837867

SHA512
33fb109a30a624777765c33d6239661050c9234fda8e17a8f5815490c34237f04d59a088d8b8f20e2280db668fb3caeaec1ce4c19f3ac0bc4e85a2134dbbab62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs.js

Filesize
6KB

MD5
15bf6741e0682b54cfd5dca4cdc72cd9

SHA1
b06901ac9cb99be6bee6c08ab8955445985f9c10

SHA256
534c40904aa70d3e84b1ece7da2c9b365668f7ac6c2fabe4db8940fcc977d172

SHA512
1509a2fd04f074ed78551a0bbc0021c70df6ac51710d725e1c1f0d12a5d5a265a0a271192c55f4d5df613710883fd7a85f2775c7c28a8ac5a573b6f93037dcc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
d3c040b768db722efd66781efb89ae49

SHA1
ec3d9812c129efba681e6b05f910daf053667124

SHA256
d5b5709ff8d7df2a82abd2450c9e7f7142cfee272b62bb6e872dd392c3149d7d

SHA512
713d62960b609640d985179bcefd4fd6702f96a921d98fb6662a77f3f614ca13f6c897b6dff4fb4802f3db6ea7cfec934a4f8dc58057196b80f80b31885fe148

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d850b3cb282885eb49490501d01a6a53

SHA1
a223de123ec5eddc487693fbbebdbf8f7752f57b

SHA256
c71bfb2a54b9a991491d16731c4007d35c589c00eeceb4d128bb94cc0108c42e

SHA512
806e189abc10fe5a2499f60a53aaf24f318d57531954f0eb9e889fb55fca576b0ba6a6030ecb06d9aa07c51981048fa4171551b834218bdb747ede8e739b538f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
81dfdbebaf350f781cebe4abe3f07e84

SHA1
889a42be79f98d2900c25e41f7448f8b2499d85d

SHA256
2d59272f2b9007fd4380d7c3c782e89b64687256f163fe43210e37c4618063ba

SHA512
447741dfc514884f31665c50c4f15aa77db8643c0c0afe87ef9aeb166b12953ce28e5830385783843e67cd67173058aa68d9e898bba1470f2aab1d2b871bfbc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
8f510ada2024f8cd6b9699023a89d132

SHA1
f80f73040f59293e111a7379abfc89b3a03434d3

SHA256
215c51a1f641b5d46231c2bb05cc7358c7cd209743e149d4ba839e07e48d5028

SHA512
024478aba682191d2b50d3318c9cd078d886fda74508ed6891607673f9d5de585bd2ec605246049b6f912e52462814dff9d44aeac196a3ca7318a2aafff5f9f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\storage\default\https+++www.malwarebytes.com\ls\usage

Filesize
12B

MD5
a7a2674a396621cc72177917bf745fb5

SHA1
37e3efd7b676988a53394ec6483edefcbbb654cd

SHA256
f64dff7e17722ef0ed90310071ecf88e6da071a044adee33e40dc6d09aa0684c

SHA512
dce12c66b0d30712fcf58795589f6056e016a7819f71e6edd471f15f873bd1ee5f7cc54c38945f80ee49d052f16bb0c45ec55cfe2a9dbb88bda2c44ff0e29fbe

Download Submit
C:\Users\Admin\Downloads\MBSetup.O_e-fYqR.exe.part

Filesize
60KB

MD5
c714afea162bca51ca40e6147eb70bfb

SHA1
c97e0defcdff2121ea9f454a383e1e9eab3a2661

SHA256
4c4fd82643d6b26e1e37cdbac84f8df072c916e886a67b04b97736f61058d9d0

SHA512
814df826cfec6db7b261810b732ffea32a8d552d11050a4649b86e1216fb53a3a49c912584939cbb487d9ecc15d7a4911ba4505ba2cac79ac999f36b7ce5d9cb

Download Submit
C:\Users\Admin\Links\Desktop.lnk.420

Filesize
512B

MD5
23409dd5381d3de95e2f7d6b88b4f3ec

SHA1
1bd6af9dac0ff10e00376e8333ba0d7f22973a2f

SHA256
b734666e17777a82b6401247fe6779255b553385998b69b33a85519abf7fcf8e

SHA512
b7b7509be0920cf36964af98dea0d7773224f196e0705f9444c1a8ae7ed98404fd77609da89e48f6dcfc09966574b134c48368aab453ecb83aefc9653e31e082

Download Submit
C:\Users\Admin\Links\Downloads.lnk.420

Filesize
960B

MD5
f9ed7801184cca8e99883dbda92e7450

SHA1
9e06e90660d25aaa7372e875c231edb864f60573

SHA256
0a8df84ab6be30d418ad8c97e98adc5f5784118d94140d0ab5a59cbc80768a25

SHA512
eab38eb53bffcc21513f240c0898b45656d18c84b105af86e45da7bb151e81b656bd16f59033079996ae1ea55778bddf0656d2aceb89e1597ebaebac533390c1

Download Submit
C:\Windows\System32\DriverStore\Temp\{b23a9013-7e02-034f-bd3b-3b147944a18b}\mbtun.cat

Filesize
10KB

MD5
8abff1fbf08d70c1681a9b20384dbbf9

SHA1
c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6

SHA256
9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658

SHA512
37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

Download Submit
C:\Windows\System32\DriverStore\Temp\{b23a9013-7e02-034f-bd3b-3b147944a18b}\mbtun.sys

Filesize
107KB

MD5
83d4fba999eb8b34047c38fabef60243

SHA1
25731b57e9968282610f337bc6d769aa26af4938

SHA256
6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c

SHA512
47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

Download Submit
C:\Windows\System32\Seven.dll

Filesize
1.5MB

MD5
306ce3e2f80f0ff752214555d9d5fc34

SHA1
2b0ba37d8bc1c72320d20af4630a426ef5e46693

SHA256
d49ecd70157b1b1f11db4acde529c285e551ceb020b5b7911ae2f42ebd9117ad

SHA512
d72e1c10404317b9bcfd311312ebdbd08177d213e85882a78833f4bcab005ca299a83e26a2fb2650932b25378776c538190b1ce8e6252b67ea21e488f4576098

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json

Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
C:\Windows\System32\Winhost.exe

Filesize
139KB

MD5
350273e0d2e8a9ba5e37b791016112a0

SHA1
5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71

SHA256
27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba

SHA512
b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b

Download Submit
C:\Windows\System32\drivers\mbamswissarmy.sys

Filesize
233KB

MD5
4b2cc2d3ebf42659ea5e6e63584e1b76

SHA1
0042da8151f2e10a31ecceb60795eb428316e820

SHA256
3db4366ccb9d94062388000926c060e2524c7d3ee4b6b7c7cf06f909f747fc6c

SHA512
804d64d346b3dbb1ce3095a5d0fa7acc5da0bf832c458e557dac486559fe53144f15f08c444fea84a01471fd5981e68801a809b143c56b5b63e3e16de9db0d98

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\7z.dll

Filesize
2.5MB

MD5
a144e24209683e3cba6e29dab5764162

SHA1
ab2112cce717bec8f5667721a072d790484095ec

SHA256
b2ff9dbf90cbd0c45cd7d95ce4892377ec7e92970e05f2e56b0ce93861190348

SHA512
2c823981b53b7eb7c1b726468d3b28c234c7e555aab35e759e88d38658566d267a20867f1cb18d96c830e7d53643629a9fa313eecee8b553703086fbb64cc984

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

Filesize
372B

MD5
d94cf983fba9ab1bb8a6cb3ad4a48f50

SHA1
04855d8b7a76b7ec74633043ef9986d4500ca63c

SHA256
1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

SHA512
09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\ctlrpkg\mbae64.sys

Filesize
154KB

MD5
95515708f41a7e283d6725506f56f6f2

SHA1
9afc20a19db3d2a75b6915d8d9af602c5218735e

SHA256
321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

SHA512
d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\dbclspkg\MBAMCoreV5.dll

Filesize
6.7MB

MD5
b2763acfd7ac2ce596a4f3a930dd2a3f

SHA1
ac18df54e4b64268e93b6e0af650d6cd8fe60274

SHA256
3b8fdecc7155bbb62b1d76aa30f06bf079924bc794cf700f5d51ade13444d049

SHA512
40b9f4bd1dc10034a5b18d3c0d2447a98aa6e4655d5d43b22aae83720e9eda8f818cf7febc0e8d0cd3b3f051805407a6112b66eb4fddd49ae2ca882a1aaa57b3

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll

Filesize
1.3MB

MD5
3143ffcfcc9818e0cd47cb9a980d2169

SHA1
72f1932fda377d3d71cb10f314fd946fab2ea77a

SHA256
b7fb9547e4359f6c116bd0dbe36a8ed05b7a490720f5a0d9013284be36b590b7

SHA512
904800d157eb010e7d17210f5797409fea005eed46fbf209bca454768b28f74ff3ff468eaad2cfd3642155d4978326274331a0a4e2c701dd7017e56ddfe5424b

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\servicepkg\MBAMService.exe

Filesize
8.5MB

MD5
e6cf1696f6396dec46b3b3f54abb544c

SHA1
7ea1424a035731d47d28dfe7e67d9d58400dfada

SHA256
77f7a44fbb9b0f0ee9cd4793cb617078d6e41d88b3c9cbbfe04be8b25e5428dd

SHA512
1c65e61e322d6e9ceea7d3357b275798a7eb661285e18f57f5c0fa11d6d99af9ac42d503848cfb9f805838c795b3f774c177b97f351bbcbbedb45c03bdb0637f

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\servicepkg\mbamelam.cat

Filesize
10KB

MD5
60608328775d6acf03eaab38407e5b7c

SHA1
9f63644893517286753f63ad6d01bc8bfacf79b1

SHA256
3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

SHA512
9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\servicepkg\mbamelam.inf

Filesize
2KB

MD5
c481ad4dd1d91860335787aa61177932

SHA1
81633414c5bf5832a8584fb0740bc09596b9b66d

SHA256
793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

SHA512
d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

Download Submit
C:\Windows\Temp\MBInstallTempe7a1a981065211ef8166f24b122c2885\servicepkg\mbamelam.sys

Filesize
20KB

MD5
9e77c51e14fa9a323ee1635dc74ecc07

SHA1
a78bde0bd73260ce7af9cdc441af9db54d1637c2

SHA256
b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

SHA512
a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186

Download Submit
memory/5084-6-0x0000021FF9380000-0x0000021FF93A2000-memory.dmp

Filesize
136KB

Download
memory/5084-13-0x0000021FF9200000-0x0000021FF9210000-memory.dmp

Filesize
64KB

Download
memory/5084-12-0x0000021FF9200000-0x0000021FF9210000-memory.dmp

Filesize
64KB

Download
memory/5084-16-0x00007FFA87D50000-0x00007FFA88811000-memory.dmp

Filesize
10.8MB

Download
memory/5084-11-0x00007FFA87D50000-0x00007FFA88811000-memory.dmp

Filesize
10.8MB

Download
memory/5112-598-0x00007FF7A2A90000-0x00007FF7A2AF7000-memory.dmp

Filesize
412KB

Download
memory/5336-599-0x00007FF7A2A90000-0x00007FF7A2AF7000-memory.dmp

Filesize
412KB

Download
memory/10748-593-0x00007FFAA8A10000-0x00007FFAA8C05000-memory.dmp

Filesize
2.0MB

Download
memory/17624-592-0x00007FF7A2A90000-0x00007FF7A2AF7000-memory.dmp

Filesize
412KB

Download
memory/18560-597-0x00007FF7A2A90000-0x00007FF7A2AF7000-memory.dmp

Filesize
412KB

Download
memory/18576-594-0x00007FF7A2A90000-0x00007FF7A2AF7000-memory.dmp

Filesize
412KB

Download
memory/18956-591-0x00007FF7A2A90000-0x00007FF7A2AF7000-memory.dmp

Filesize
412KB

Download