8239006e0b4296c0003ebf8a8955d40e7cb751efbcbf6e98490f76ca89bb4538

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/03/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.bat
Size 1KB
Sample260322-ypbzesfs4w
SHA256 8239006e0b4296c0003ebf8a8955d40e7cb751efbcbf6e98490f76ca89bb4538
MD5 9c09ea8c84e71612faaa6471b0a971f8
SHA1 ee966616bc8ecff690707762f63b682336987070
SHA512 c0e21616eff796772be507c33a80a55cc15f330ef7a8bec5ed7902a318a2597e8bfbdc36f7b1af1720fb897b414240e24f10727714675f83b2839ba3c55b890a
TLSH
T1E42151A7B701F413ABA4CA81C45EBD08FD0A715F9ED0AD97B45A542E4D1BCE1B1DC840
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
10044	PING.EXE
9688	PING.EXE
10584	PING.EXE
1172	PING.EXE
8784	PING.EXE
13296	PING.EXE
15372	PING.EXE
9428	PING.EXE
10592	PING.EXE
10456	PING.EXE
9548	PING.EXE
6436	PING.EXE
8364	PING.EXE
8660	PING.EXE
9852	PING.EXE
10184	PING.EXE
8300	PING.EXE
8356	PING.EXE
8888	PING.EXE
8224	PING.EXE
9088	PING.EXE
5132	PING.EXE
7084	PING.EXE
9956	PING.EXE
9388	PING.EXE
14960	PING.EXE
14924	PING.EXE
9028	PING.EXE
9344	PING.EXE
9860	PING.EXE
9708	PING.EXE
8308	PING.EXE
8964	PING.EXE
9872	PING.EXE
9928	PING.EXE
10136	PING.EXE
9612	PING.EXE
15388	PING.EXE
16228	PING.EXE
5980	PING.EXE
8332	PING.EXE
8540	PING.EXE
8668	PING.EXE
8840	PING.EXE
9500	PING.EXE
9920	PING.EXE
10020	PING.EXE
9760	PING.EXE
9752	PING.EXE
15556	PING.EXE
4980	PING.EXE
9228	PING.EXE
8740	PING.EXE
6360	PING.EXE
6232	PING.EXE
9060	PING.EXE
9364	PING.EXE
9772	PING.EXE
15140	PING.EXE
8188	PING.EXE
9732	PING.EXE
9888	PING.EXE
14908	PING.EXE
14384	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
11972	msedge.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134186830994703932"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{B32F710E-5953-4341-9888-9F66A60E348B}	msedge.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
12436	PING.EXE
6384	PING.EXE
9872	PING.EXE
10332	PING.EXE
10324	PING.EXE
8732	PING.EXE
15140	PING.EXE
14592	PING.EXE
6272	PING.EXE
5980	PING.EXE
9716	PING.EXE
9236	PING.EXE
8784	PING.EXE
9060	PING.EXE
3408	PING.EXE
9760	PING.EXE
9732	PING.EXE
10136	PING.EXE
8776	PING.EXE
16316	PING.EXE
10592	PING.EXE
8300	PING.EXE
8364	PING.EXE
8964	PING.EXE
6360	PING.EXE
8792	PING.EXE
9012	PING.EXE
9592	PING.EXE
9888	PING.EXE
15496	PING.EXE
4980	PING.EXE
3408	PING.EXE
8324	PING.EXE
8840	PING.EXE
9740	PING.EXE
9928	PING.EXE
9660	PING.EXE
9252	PING.EXE
9712	PING.EXE
9672	PING.EXE
9964	PING.EXE
9860	PING.EXE
9244	PING.EXE
14640	PING.EXE
16228	PING.EXE
116	PING.EXE
8212	PING.EXE
8668	PING.EXE
8660	PING.EXE
8888	PING.EXE
10004	PING.EXE
9260	PING.EXE
8228	PING.EXE
8384	PING.EXE
10584	PING.EXE
13296	PING.EXE
8220	PING.EXE
1172	PING.EXE
7008	PING.EXE
8308	PING.EXE
8936	PING.EXE
9364	PING.EXE
9500	PING.EXE
12244	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
11236	msedge.exe
11236	msedge.exe
11236	msedge.exe
11236	msedge.exe
11236	msedge.exe
11236	msedge.exe
11236	msedge.exe
11236	msedge.exe
16180	msedge.exe
16180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14424	dwm.exe
Token: SeChangeNotifyPrivilege	14424	dwm.exe
Token: 33	14424	dwm.exe
Token: SeIncBasePriorityPrivilege	14424	dwm.exe
Token: SeCreateGlobalPrivilege	15492	dwm.exe
Token: SeChangeNotifyPrivilege	15492	dwm.exe
Token: 33	15492	dwm.exe
Token: SeIncBasePriorityPrivilege	15492	dwm.exe
Token: SeCreateGlobalPrivilege	6580	dwm.exe
Token: SeChangeNotifyPrivilege	6580	dwm.exe
Token: 33	6580	dwm.exe
Token: SeIncBasePriorityPrivilege	6580	dwm.exe
Token: SeCreateGlobalPrivilege	7644	dwm.exe
Token: SeChangeNotifyPrivilege	7644	dwm.exe
Token: 33	7644	dwm.exe
Token: SeIncBasePriorityPrivilege	7644	dwm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3308	4964	cmd.exe	85
PID 4964 wrote to memory of 1776	4964	cmd.exe	86
PID 4964 wrote to memory of 3056	4964	cmd.exe	89
PID 4964 wrote to memory of 5820	4964	cmd.exe	90
PID 4964 wrote to memory of 2672	4964	cmd.exe	92
PID 4964 wrote to memory of 5068	4964	cmd.exe	95
PID 4964 wrote to memory of 2540	4964	cmd.exe	97
PID 4964 wrote to memory of 6124	4964	cmd.exe	98
PID 4964 wrote to memory of 1900	4964	cmd.exe	99
PID 4964 wrote to memory of 3576	4964	cmd.exe	100
PID 4964 wrote to memory of 2068	4964	cmd.exe	104
PID 4964 wrote to memory of 1584	4964	cmd.exe	107
PID 4964 wrote to memory of 1244	4964	cmd.exe	109
PID 4964 wrote to memory of 4796	4964	cmd.exe	110
PID 4964 wrote to memory of 1580	4964	cmd.exe	112
PID 4964 wrote to memory of 5628	4964	cmd.exe	115
PID 4964 wrote to memory of 4028	4964	cmd.exe	116
PID 4964 wrote to memory of 2692	4964	cmd.exe	118
PID 4964 wrote to memory of 3528	4964	cmd.exe	120
PID 4964 wrote to memory of 3988	4964	cmd.exe	121
PID 4964 wrote to memory of 1716	4964	cmd.exe	122
PID 4964 wrote to memory of 3400	4964	cmd.exe	123
PID 4964 wrote to memory of 1028	4964	cmd.exe	124
PID 4964 wrote to memory of 2340	4964	cmd.exe	125
PID 4964 wrote to memory of 5172	4964	cmd.exe	126
PID 4964 wrote to memory of 3512	4964	cmd.exe	127
PID 4964 wrote to memory of 5460	4964	cmd.exe	128
PID 4964 wrote to memory of 1688	4964	cmd.exe	129
PID 4964 wrote to memory of 5492	4964	cmd.exe	130
PID 4964 wrote to memory of 3288	4964	cmd.exe	131
PID 4964 wrote to memory of 3284	4964	cmd.exe	132
PID 4964 wrote to memory of 3784	4964	cmd.exe	133
PID 4964 wrote to memory of 5192	4964	cmd.exe	134
PID 4964 wrote to memory of 2148	4964	cmd.exe	135
PID 4964 wrote to memory of 1184	4964	cmd.exe	152
PID 4964 wrote to memory of 5356	4964	cmd.exe	153
PID 4964 wrote to memory of 5304	4964	cmd.exe	154
PID 4964 wrote to memory of 3732	4964	cmd.exe	156
PID 4964 wrote to memory of 396	4964	cmd.exe	157
PID 4964 wrote to memory of 4456	4964	cmd.exe	158
PID 4964 wrote to memory of 5808	4964	cmd.exe	159
PID 4964 wrote to memory of 5620	4964	cmd.exe	166
PID 4964 wrote to memory of 4080	4964	cmd.exe	169
PID 4964 wrote to memory of 1640	4964	cmd.exe	170
PID 4964 wrote to memory of 5252	4964	cmd.exe	171
PID 4964 wrote to memory of 5672	4964	cmd.exe	172
PID 4964 wrote to memory of 5676	4964	cmd.exe	173
PID 4964 wrote to memory of 632	4964	cmd.exe	174
PID 4964 wrote to memory of 4880	4964	cmd.exe	175
PID 4964 wrote to memory of 5764	4964	cmd.exe	182
PID 4964 wrote to memory of 1376	4964	cmd.exe	185
PID 4964 wrote to memory of 4280	4964	cmd.exe	187
PID 4964 wrote to memory of 1728	4964	cmd.exe	188
PID 4964 wrote to memory of 1492	4964	cmd.exe	191
PID 4964 wrote to memory of 5992	4964	cmd.exe	192
PID 4964 wrote to memory of 5688	4964	cmd.exe	193
PID 4964 wrote to memory of 6140	4964	cmd.exe	196
PID 4964 wrote to memory of 2736	4964	cmd.exe	199
PID 4964 wrote to memory of 4300	4964	cmd.exe	201
PID 4964 wrote to memory of 4292	4964	cmd.exe	203
PID 4964 wrote to memory of 3744	4964	cmd.exe	204
PID 4964 wrote to memory of 4976	4964	cmd.exe	205
PID 4964 wrote to memory of 3992	4964	cmd.exe	206
PID 4964 wrote to memory of 4040	4964	cmd.exe	207

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos1.bat
  2⤵
  PID:3308
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8220
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos1.bat
    3⤵
    PID:10608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos2.bat
  2⤵
  PID:1776
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:6264
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos2.bat
    3⤵
    PID:7736
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:10332
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos3.bat
  2⤵
  PID:3056
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8332
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos3.bat
    3⤵
    PID:10920
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:13296
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos3.bat
      4⤵
      PID:13420
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:5884
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:2844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos3.bat
        5⤵
        
        PID:4536
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:7296
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7308
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos3.bat
        6⤵
        
        PID:7408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos4.bat
  2⤵
  PID:5820
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6232
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos4.bat
    3⤵
    PID:8160
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10812
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos4.bat
      4⤵
      PID:11500
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:15140
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:15284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos4.bat
        5⤵
        
        PID:10164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos5.bat
  2⤵
  PID:2672
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:6272
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos5.bat
    3⤵
    PID:7200
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:8540
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos5.bat
      4⤵
      PID:11508
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:15024
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:14916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos5.bat
        5⤵
        
        PID:13572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos6.bat
  2⤵
  PID:5068
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8300
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos6.bat
    3⤵
    PID:11120
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:9712
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos6.bat
      4⤵
      PID:12864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos6.bat
        5⤵
        
        PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos7.bat
  2⤵
  PID:2540
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8348
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos7.bat
    3⤵
    PID:10948
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:8224
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos7.bat
      4⤵
      PID:12320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos8.bat
  2⤵
  PID:6124
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8384
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos8.bat
    3⤵
    PID:11204
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos8.bat
      4⤵
      PID:14680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos9.bat
  2⤵
  PID:1900
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8324
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos9.bat
    3⤵
    PID:11168
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:9088
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:1124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos9.bat
      4⤵
      PID:1104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:13236
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5132
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos10.bat
  2⤵
  PID:3576
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5980
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos10.bat
    3⤵
    PID:7348
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:9428
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos10.bat
      4⤵
      PID:13112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos11.bat
  2⤵
  PID:2068
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6360
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos11.bat
    3⤵
    PID:7696
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:9244
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos11.bat
      4⤵
      PID:10244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos12.bat
  2⤵
  PID:1584
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8340
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos12.bat
    3⤵
    PID:8312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos13.bat
  2⤵
  PID:1244
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:6384
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos13.bat
    3⤵
    PID:6320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6328
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:10324
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos14.bat
  2⤵
  PID:4796
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8228
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos14.bat
    3⤵
    PID:10640
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos15.bat
  2⤵
  PID:1580
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8364
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos15.bat
    3⤵
    PID:8236
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos15.bat
      4⤵
      PID:9556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:9244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos16.bat
  2⤵
  PID:5628
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8356
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos16.bat
    3⤵
    PID:8272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos17.bat
  2⤵
  PID:4028
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8212
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos17.bat
    3⤵
    PID:10600
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:14960
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos17.bat
      4⤵
      PID:12316
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:14140
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos18.bat
  2⤵
  PID:2692
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8732
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos18.bat
    3⤵
    PID:13040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos19.bat
  2⤵
  PID:3528
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8660
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos19.bat
    3⤵
    PID:12328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos20.bat
  2⤵
  PID:3988
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8724
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos20.bat
    3⤵
    PID:12676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos21.bat
  2⤵
  PID:1716
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8800
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos21.bat
    3⤵
    PID:12564
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:16316
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos21.bat
      4⤵
      PID:14924
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:116
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:3360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos21.bat
        5⤵
        
        PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos22.bat
  2⤵
  PID:3400
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos23.bat
  2⤵
  PID:1028
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8308
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos23.bat
    3⤵
    PID:8384
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:14640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos23.bat
      4⤵
      PID:15352
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:10556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos24.bat
  2⤵
  PID:2340
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8792
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos24.bat
    3⤵
    PID:9432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos25.bat
  2⤵
  PID:5172
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8808
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos25.bat
    3⤵
    PID:13264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos26.bat
  2⤵
  PID:3512
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:6328
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos26.bat
    3⤵
    PID:7712
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:10584
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:8828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos26.bat
      4⤵
      PID:12516
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:15448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos27.bat
  2⤵
  PID:5460
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8856
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos28.bat
  2⤵
  PID:1688
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8784
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos28.bat
    3⤵
    PID:10328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos29.bat
  2⤵
  PID:5492
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8840
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos29.bat
    3⤵
    PID:13288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos30.bat
  2⤵
  PID:3288
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8936
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos30.bat
    3⤵
    PID:12600
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:14384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos31.bat
  2⤵
  PID:3284
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8776
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos31.bat
    3⤵
    PID:13804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos32.bat
  2⤵
  PID:3784
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8652
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos32.bat
    3⤵
    PID:9284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos33.bat
  2⤵
  PID:5192
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6436
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos33.bat
    3⤵
    PID:8032
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:10592
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:8724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos33.bat
      4⤵
      PID:10556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos34.bat
  2⤵
  PID:2148
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8768
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos34.bat
    3⤵
    PID:14380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos35.bat
  2⤵
  PID:1184
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8236
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos35.bat
    3⤵
    PID:10912
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13924
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos35.bat
      4⤵
      PID:11308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos36.bat
  2⤵
  PID:5356
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8864
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos37.bat
  2⤵
  PID:5304
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8824
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos37.bat
    3⤵
    PID:13056
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:15496
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos37.bat
      4⤵
      PID:9828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos38.bat
  2⤵
  PID:3732
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8740
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos38.bat
    3⤵
    PID:12368
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15892
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos38.bat
      4⤵
      PID:15628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos39.bat
  2⤵
  PID:396
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8668
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos39.bat
    3⤵
    PID:13000
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos40.bat
  2⤵
  PID:4456
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8760
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos41.bat
  2⤵
  PID:5808
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8748
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos41.bat
    3⤵
    PID:13212
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15640
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:16020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos41.bat
      4⤵
      PID:16100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos42.bat
  2⤵
  PID:5620
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9276
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos42.bat
    3⤵
    PID:13316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos43.bat
  2⤵
  PID:4080
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9228
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos43.bat
    3⤵
    PID:13120
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9716
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:14592
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos44.bat
  2⤵
  PID:1640
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9260
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos44.bat
    3⤵
    PID:10360
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:12436
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos44.bat
      4⤵
      PID:15800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos45.bat
  2⤵
  PID:5252
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8964
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos45.bat
    3⤵
    PID:15040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos46.bat
  2⤵
  PID:5672
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9020
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos46.bat
    3⤵
    PID:14316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos47.bat
  2⤵
  PID:5676
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9060
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos47.bat
    3⤵
    PID:12648
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4980
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:5744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos47.bat
      4⤵
      PID:4720
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:7008
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:1032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos47.bat
        5⤵
        
        PID:6176
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:8000
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:8012
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos47.bat
        6⤵
        
        PID:8020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos48.bat
  2⤵
  PID:632
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9236
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos48.bat
    3⤵
    PID:9112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos49.bat
  2⤵
  PID:4880
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9336
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos49.bat
    3⤵
    PID:10124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos50.bat
  2⤵
  PID:5764
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8984
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos50.bat
    3⤵
    PID:13096
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos51.bat
  2⤵
  PID:1376
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8704
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos51.bat
    3⤵
    PID:8720
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:14908
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos51.bat
      4⤵
      PID:15784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos52.bat
  2⤵
  PID:4280
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9012
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos53.bat
  2⤵
  PID:1728
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:3408
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos53.bat
    3⤵
    PID:9940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos54.bat
  2⤵
  PID:1492
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1172
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos54.bat
    3⤵
    PID:9348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos55.bat
  2⤵
  PID:5992
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9000
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos55.bat
    3⤵
    PID:13104
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:9548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos56.bat
  2⤵
  PID:5688
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9268
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos56.bat
    3⤵
    PID:14628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos57.bat
  2⤵
  PID:6140
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8548
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos57.bat
    3⤵
    PID:11592
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:14924
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:1340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos57.bat
      4⤵
      PID:10524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos58.bat
  2⤵
  PID:2736
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9252
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos58.bat
    3⤵
    PID:10364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos59.bat
  2⤵
  PID:4300
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos60.bat
  2⤵
  PID:4292
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8564
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos60.bat
    3⤵
    PID:11616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos61.bat
  2⤵
  PID:3744
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9772
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos62.bat
  2⤵
  PID:4976
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos63.bat
  2⤵
  PID:3992
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos64.bat
  2⤵
  PID:4040
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:10036
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos64.bat
    3⤵
    PID:13048
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:15388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos65.bat
  2⤵
  PID:4860
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:10184
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos65.bat
    3⤵
    PID:14940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos66.bat
  2⤵
  PID:4920
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9544
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos67.bat
  2⤵
  PID:4884
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8188
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos67.bat
    3⤵
    PID:8572
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:12244
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos67.bat
      4⤵
      PID:15020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos68.bat
  2⤵
  PID:4888
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9660
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos68.bat
    3⤵
    PID:12448
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:14848
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos68.bat
      4⤵
      PID:15980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos69.bat
  2⤵
  PID:4928
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9716
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos70.bat
  2⤵
  PID:5076
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9760
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos70.bat
    3⤵
    PID:13816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos71.bat
  2⤵
  PID:1160
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9572
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos71.bat
    3⤵
    PID:15000
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:16228
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:3676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos71.bat
      4⤵
      PID:212
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:7084
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:14352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos71.bat
        5⤵
        
        PID:6728
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:7792
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:7872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos71.bat
        6⤵
        
        PID:7884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos72.bat
  2⤵
  PID:564
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9600
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos72.bat
    3⤵
    PID:11640
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:8784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos73.bat
  2⤵
  PID:4868
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9420
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos73.bat
    3⤵
    PID:13008
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:10456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos74.bat
  2⤵
  PID:4840
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:10004
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos75.bat
  2⤵
  PID:4932
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9860
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos76.bat
  2⤵
  PID:4940
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9708
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos76.bat
    3⤵
    PID:10428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos77.bat
  2⤵
  PID:4952
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9344
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos77.bat
    3⤵
    PID:13832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos78.bat
  2⤵
  PID:5004
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9388
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos79.bat
  2⤵
  PID:5816
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9920
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos79.bat
    3⤵
    PID:14140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos80.bat
  2⤵
  PID:4996
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9800
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos80.bat
    3⤵
    PID:13416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos81.bat
  2⤵
  PID:4244
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9732
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos81.bat
    3⤵
    PID:8664
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:1332
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos81.bat
      4⤵
      PID:15540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos82.bat
  2⤵
  PID:544
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9592
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos82.bat
    3⤵
    PID:8816
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:15372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos83.bat
  2⤵
  PID:2520
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9672
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos83.bat
    3⤵
    PID:8696
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos84.bat
  2⤵
  PID:5600
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9364
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos84.bat
    3⤵
    PID:10088
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:15556
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos84.bat
      4⤵
      PID:10164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos85.bat
  2⤵
  PID:6148
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9688
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos85.bat
    3⤵
    PID:14684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos86.bat
  2⤵
  PID:6196
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9500
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos86.bat
    3⤵
    PID:13824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos87.bat
  2⤵
  PID:6256
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos88.bat
  2⤵
  PID:6348
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:10020
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos89.bat
  2⤵
  PID:6400
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9612
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos90.bat
  2⤵
  PID:6480
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9872
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos91.bat
  2⤵
  PID:6536
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:10136
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos91.bat
    3⤵
    PID:14580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos92.bat
  2⤵
  PID:6656
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8888
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos92.bat
    3⤵
    PID:13844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos93.bat
  2⤵
  PID:6796
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9852
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos93.bat
    3⤵
    PID:10396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos94.bat
  2⤵
  PID:6928
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:10044
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos94.bat
    3⤵
    PID:14372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos95.bat
  2⤵
  PID:7040
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:10052
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos95.bat
    3⤵
    PID:14556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos96.bat
  2⤵
  PID:7088
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9992
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos96.bat
    3⤵
    PID:12488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos97.bat
  2⤵
  PID:7120
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9964
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos98.bat
  2⤵
  PID:1292
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9928
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos99.bat
  2⤵
  PID:7172
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9752
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos99.bat
    3⤵
    PID:12892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos100.bat
  2⤵
  PID:7252
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9956
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos100.bat
    3⤵
    PID:14564
- C:\Windows\system32\PING.EXE
  ping localhost -n 3
  2⤵
  - Runs ping.exe
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:11064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://.../
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7fff963cc188,0x7fff963cc194,0x7fff963cc1a0
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:11236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=107614701469872 --process=264 /prefetch:7 --thread=9832
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:16180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,4989542560228733752,11567007471596208103,524288 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:3
      4⤵
      System Time Discovery
      PID:11972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,12321575243208036903,2650910727820155742,262144 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
      4⤵
      PID:11988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,2313839086914237046,12492422949101424852,524288 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
      4⤵
      PID:11996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,637745274476405306,12554425741759891007,2097152 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:12176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14395873547679055171,13944446097866147262,2097152 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:12184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13851471285644402566,11747426158043210502,2097152 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:11312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4948,i,9982727259220240955,1968265425362688706,2097152 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:10168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5288,i,5196973029516031961,12806062266281576388,2097152 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:10456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5516,i,16687198884757448279,18412809171578193237,2097152 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:14176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,5581331731081815706,2542657316377687763,524288 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
      4⤵
      PID:9384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,10203288372661840882,9409716778938245032,524288 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
      4⤵
      PID:14012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,3560282216171148365,7225583888103976380,524288 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:14228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:13916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,3560282216171148365,7225583888103976380,524288 --field-trial-handle=2712,i,7742346390446179431,16146975840403219633,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:9700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:11444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:11828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:12268

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 8e61b07b74ac6903fcd56b4455490f9e ubK3/FMSPEeI7zcguvAuVg.0.1.0.0.0
1⤵
PID:14608

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14424

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15492

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6580

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f6da0e853ab236b62a5408fe03d4f1bf01fbc962a0c1c76d4b0aa6b7fdfa4d37
MD5 5e483ca28fcff2cc1e24ba1565a30ce7
SHA1 8ffe3aa024bf28e8455ade9e81210e605f0a67cd
SHA512 c731e285938d4857804a90a668363bcaf5072e8d3436b5f5eb9514969f44a93fb6ea1e798428a9421dd942737ed7cc01edeefa0d263c711fe03fdfea191defd3
TLSH
T19EE02BA9CD62EC270CFD17585054068AFB4413572682488F3E3C82088FB1A3B458685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5a231935092b6e0b7944dd273e6004b2f1b0217088651eae8b0c074971647154
MD5 e6280c176708ea26a52214fe364c47db
SHA1 d66cf14a6ae3db1f49ec77a8c67080f45885b948
SHA512 b404b6ff7454eef165ec5f13ce4d50e13612d898ad4b4ec48ba70664f86baed969c0798883104b467f53ce344adae7b197ee17b0e27b025d873a853cda30f18e
TLSH
T18B219DF743B4856E9B1191F0EA187E2FCE6D0510536C7DEAC5F0AE1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a77785ce2043573dc3bb9c152647e8d7ec91a9ac69e2b5f6f8455027f13608ac
MD5 832b0c8c7a39902f54ae940110daee1e
SHA1 1d8586c3ab13d8cd5a5b4ebe7656af1151628d38
SHA512 8cd5ab1e1c861ef46e483899eacdee4954865c72d81479dcd04663855a2b9038138dfb4f1b81352c8d0973a45f242e7eeb33c91f0eeda8b37a30584cf96b1d56
SSDEEP 192:sxZoRsyMqZ/K1Ml8MjP/fjso8f+kvqrjrIzodpLHW6+WNGYK8kmHHIgjrJ:sxZoJ7P/fjsNf+aibLHbGNmnj9
TLSH
T1A562E715AA38997BCCDBD209FA557B93D7F85573D1800E4899FCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c343ce76512d3a800f3d16dd3b61997ca2a25fa9b52e445fabea17bf385ceec6
MD5 bd35193c6204686a2de5cbfb08d9729b
SHA1 5057d9d9ddc838db95251a39a581ce0a63d057f5
SHA512 efd7ef2cde8bbfc86b197de63ff07f3560e285f4bfc56e9353913034c9e4fadad61349e5a9639e95cb2b100afbf07422b586d69a20ccae5c73d5e48ef712656e
SSDEEP 768:DXgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6MKJLlhzCpUro4:DXgLiAUE/aeWvaShqu1javMKJLDOp/4
TLSH
T1E6F20C3B2C0CCB7E4F844E9CED2ABE8E6DE402CB9698895447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bcfaa51746be28ad7a3513fc72328eb00768ea607b08dc22ba6ab94634fe794e
MD5 5b5cc240709e93f4babcfa143e8171e6
SHA1 b1338cd983a367638a9cf51575ce0f520670fa7a
SHA512 fbf7a93338ac8df3fccf7e96cb6bf12bca14c6991918f480d0cdda0d6cf8711d120a83818c4d1392fbd6a70027175d508744d07057f3373a1d996fa53c017ce5
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BNjnQ:krN/INhx+kcxKBzxNDQ
TLSH
T162B23911717A42903A7E398E8595B82F66C230633098F53B7BB914A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cd5758ac4debf3a7d43f48e1586fbc60de0be71fd96ebed67ba93533bb60b04e
MD5 c193c08d116c37934e29785e6cd4cde7
SHA1 e5beeb06490f33162c10668b5f1e94accced5c5b
SHA512 11fa93751fc7d2a4e3b6ce9e56f1f00ea634b057510aaf4901e4b846207f89da3d3a5ac5c1cfd39e719cf708fe0a81171b3e040322130da3e90a5bd7aa3484d2
SSDEEP 384:nGiFavqMg3sN/8TUNTUlIm2ZTPENx6Owf3YQA+I+6MUH3Ra43GrN1k+5vI+6J:tFayv3qwgHOyY/+d6M83RaDS
TLSH
T1CAC24A35ECA8DEABEDE69FD9A7097603EFE05167D48C0AD4DAD81D0D009719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e10eead6930dfd68270323ea3ce45fee65d6cfb03b87283c755363c3b01a0666
MD5 6d235f2d40d9be8f1d4846b154559977
SHA1 84b1b595131190fd7b937c60c5cef7f559fac06a
SHA512 79372daf65acc4a9aad8e4eefd6e898734aebf71e6794e378aadc7da8ec8bd812f082e10708d6ae7fab4ea68ba95de53cb78f5e3a46298ab73c988c3140521ff
SSDEEP 384:n6iF7vqMpsNE8TUNTUlI4LZTPkZocOwf3YQA+I+xyMmJDrN1k+5vI+/1:xF7y0NwgEnsY/+dgMmpJ
TLSH
T158B23875ECA8DD6BBDE68FD9A70A3603DEE08267D58C0AD8D6D81D0D108B1DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4d38e01818859fdd957cc7bb972f712099814123d565b6f74363c0dc38e9786f
MD5 1f2f52a4c48aed38dc837ceda6cabd79
SHA1 382fa484d746106030e3abf15ea2b36e9a166d0b
SHA512 034ba43a7bf4e444311075f9c0e7902630f17e6a8e65ce160c39b8086f5905e5a9b3adc5dd5c4d0318836dcc0324b18058586b27558c3914575eb7af3981c6b3
SSDEEP 384:n6iFavqMg3sNE8TUNTUlI42ZTPJ7HOwf3YQA+I+xJMm3Ra43GrN1k+5vI+6J:xFayv3NwgthFY/+dDMm3RaDS
TLSH
T1EEC24A76EC98DDABADE69FD9A70A3603DEE08263D58C0AD4DAD82D0D00971DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b6fe065310e96e20655b43d998fc79298e66f81d4c5ae7502d52a0fd591ec05b
MD5 498681cfd0d86f64a50f9e23ee018e66
SHA1 c5ff45f84cc46e5b0eacc071b0cfa7d8e8870457
SHA512 b069b35efe8ddb5489ef0b2db3f351eca987e0272c8399ebfb0632ee895227cdb64238ede2f9906475dc87ef86d2c7b668464c17adbfab27774082ae1e27bb49
SSDEEP 384:n6iFkjccCs+Bt0S3NsNE8TUNTUlI4/ZTPkXROwf3YQA+I+xyMmpGK/Y9CrN1k+5a:xFyccQtNwgAmPY/+dgMmpV/Y+y
TLSH
T14FC24B36ECA4CD7BFDE78ED8A35A76039EE04267958C5AD4D9DC5E1C008B1AD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a90be98f9fd318baf1ed8c5b7ffebdfddb967cc804ae685ba13b1e3912a58bf6
MD5 118e366f6b055e6e45826a8e0dc845a1
SHA1 587c142dd6238ba08ff6054709013802e4beda69
SHA512 e69c013b1758c9abaa12c0424a46ae45ce6e9b3649f113b7be748dee4562a834e4ada6d4e258d342ac46f35172a704e7c412a7d6d305b91bbd6d37760215e7ed
SSDEEP 384:nwiFavqMg3sNQ8TUNTUlIm2ZTPPh0Owf3YQA+I+xJMm3Ra43GrN1k+5vI+6J:LFayv3dwgH9UY/+dDMm3RaDS
TLSH
T132C24A72EC98DDABADE69FD9A70A3603DEE08263D58C0AD4DAD82D0D00D71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 91b2506dd8d9fc5fa2bf2b7254f16400711b6d50b92f23f469fbe62337d7f2a3
MD5 8d61353f87e1bd9bd8a3966bcfd63aaf
SHA1 027507b9bea926e2ea0ed828a9ded2fe5e4e5a82
SHA512 3c7902eef0b9ad44d4dde3759a3bfa376b1bbb9d1a6f3679616458626c99f1aa096c0cba577002bcf96e42e5194eedef3e8989e7a50e30f0cda42a83632feff1
SSDEEP 384:n6iF/vqMv03sNE8TUNTUlI4nZTPJQI2Owf3YQA+I+xmMmJDrN1k+5vI+F1:xF/y803NwgM2IGY/+dEMmpr
TLSH
T16CB22875ECA8DD6BBDE68FD9A70A3603DEE08267D58C0AD8D6D81D0C108B1DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chaos1.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos1.bat
Size 172B
SHA256 293066f4d649f706faf5846d37c0f3b84f7a724b47cdb9fdeb1bba5061ff71cd
MD5 64a5afd732940961d09dffbc0ee87d6e
SHA1 1d4308628bd3b53c00ccbaa5930e3be81a1189e7
SHA512 49f201be6253beceda337bccde4ee70812273c6430ae1972c2a3d1ce0bd919c05fceb5adf3c413fa8147a8aafe5261152aaa8caf26fb63907edd2c7735e4e781
TLSH
T197C08C312D09F943291509401EA49A28300D12AF42C26E81388628B1989B8E9E6F9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos10.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos10.bat
Size 175B
SHA256 ee42e3597dfb808af5cbd3d9a164ade2c602cc8d5625687ead7d6ef680a7b4ac
MD5 8fbdaabc05f51bf6858f3e04544ee729
SHA1 46f4e5fec2652a3b471b8446be04aec1711264cc
SHA512 46415a4769e8cb0cbba263f312eae287fb3dadbab7835c1d0cd2738a2f40df2c6229a56493b1d130d5760da2b2dfb33f345771b0c5e669338c37dcddea51f953
TLSH
T12FC08C322D01F94328250A481DB5DA28300E02AF42832DC1288A2871588B8DAFAFCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos11.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos11.bat
Size 175B
SHA256 8c250b167c0c937c64a86a0aa0643f72794a622ff067808abd2e0e624ddcae48
MD5 d113594d15d540c9d095c2259a6f98b0
SHA1 9d5969bb07047e34607bd41b14b643318108d766
SHA512 0a7c51306c41f06a7b14f3218cc7c32a0f8efcf722b5799c3dc30f413d3d053393bbce7541be36e15ebff4412cc138ecdb4899763c3fd4a7e837994bfdf23374
TLSH
T161C08C722D01F943286509401EA49A28300D02AF82832E8128CA2871988BCE9E6F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos12.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos12.bat
Size 175B
SHA256 3884a919bfe7cebba5fbc9786e2c99034a63f6af549cc418475611dab512b2ff
MD5 116f35bb8a8e08c9d10c9e09dcd7080d
SHA1 8bde7944c0339caf35be6c31a669e79da090c89a
SHA512 70861ed2ac06094dd6e37048b9055663343b3737271a2db9067ceec11a7a9d53f1a31535af2bc17e0a45e00bae49351f1a03cba0bd52cf7c48a83cb71d0abf28
TLSH
T1F6C08C332D01F997286509401EA49A68300E02AF42932D812C862871588B8DAE7FDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos13.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos13.bat
Size 175B
SHA256 bc7c1ac52eedf70ba8edc5e49c7bf4ae023007dc4e92596eae19728d7825450c
MD5 f86399701270d77661c29d56b7a43420
SHA1 e956e8b0e1543c4c65e797e3e96057e5f0dd3394
SHA512 130d8e96823e760d5ac1deb956e3f25dbb4cb1a0af4ac285aab6fc513662c999bf42f9632e5485d8227b4983c998d0cebb6c7b4213e2520c2fd7bda065800a7f
TLSH
T13CC08C326D01F943283509841DA59A28300D52AF92836D9168872875598B8D9E6F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos14.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos14.bat
Size 175B
SHA256 5c0d6530a52f46ee0b3aa41e78bcebc81be9a0820bbb2e727060fdcd840908b4
MD5 8f0544e03a28966543e279a906ad3866
SHA1 cd16e71f965a3c243e1c3849480bf75eb87b338d
SHA512 69e47ca0b1d171f0f467e9d40e2b170fd59ea40b4d81e6bdd0e16c2f970f18124009aff974d0109898d54243126e53bd8361aaf751c6b47d8b8d9d068cf15599
TLSH
T12FC080311D41F543681509401D649514310D115F41832DD11486587258878DEE7F8D11
MD5 SHA1 SHA512 TLSH

Submit Download

chaos15.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos15.bat
Size 175B
SHA256 3dc0bfbcc4793b7ee3db7eb4c5336b6c5a74cde2cb134d32ea10b5a0e9a88514
MD5 a4734911421427506b0a70417b3440d8
SHA1 bc37f41b7684a146d74f3b826f2429cf3543c8e5
SHA512 e1f5ce05543440a6e6d36cd9cb70ec7a99f039bb70c82aac32e6c85a648bd14120730b49a99da94e652323926f6d36c5f8bd732a417aebbf0a71862d8421c879
TLSH
T14BC080352D01F943281509501D64E554310D015F41832DC11486187158878D5E6FC960
MD5 SHA1 SHA512 TLSH

Submit Download

chaos16.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos16.bat
Size 175B
SHA256 0a01a253bfa22e359e0105193ba267a10ea1851731f3ae9c9dfe4d875e801eb6
MD5 d93412728f315c4daafba6a17180bcbe
SHA1 d5f31a509676cf281bf805416e28e9520a97bc5d
SHA512 209060e2845c095c6e4e9acb1ab30657757f88b41c3897cd795bf9ef63ad22a73dfe1feb9aa7cf359354a730fe04701589e4cc9d0202b73be1a6148a24d2ff55
TLSH
T136C08C362D05F943282509401DB4AA28300D82AF4293AD8628876871588B8DDE6F8B20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos17.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos17.bat
Size 175B
SHA256 48b6458abbee6b985c7c0cde331b56539b0337039a2af04b605514c7edf22126
MD5 14b1c32903b4c1ba0e145593b27734c3
SHA1 709a9bd830a020320b9513b5d6260011e05eb51e
SHA512 3dccba8b5c320c81d8c39587a84d80f3eff6d6145c76ce23b3fa8ef7f000508fe5811082e2ff73bc3f96c67fd8be798aadb7d79537b13d50e4c863ab1464aa72
TLSH
T129C08C322D11F94338260A601DE49A28360D02AF42836D8128C62871588B8D9E6F8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos18.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos18.bat
Size 175B
SHA256 63af006c3c076c96d18724f811028effd2fb9bb75df31f65979d5de87d2e3c11
MD5 bec70d8fa4a1aa7cc0dd7ace03746b1b
SHA1 07f12d9da670c4bbf4f631c842896e0fcaa130ed
SHA512 625d68bcbb67993e7fce4e10f8ce3061837cce428567afef9331336bcdcf7b4815bd75bc4f0a14817580fd49dfacffc7d37805e83892886909d07f51a24a6723
TLSH
T107C080311E01F54328150D542F759514300D015F43832D811487687158878D5EEF8910
MD5 SHA1 SHA512 TLSH

Submit Download

chaos19.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos19.bat
Size 175B
SHA256 75122e55c56bca2659efe2a1ec9f20fa520214bbdb6c7e6fef39cfbabed93b8c
MD5 b78cf160f0486ab3588f53fe4b243ebd
SHA1 a557c74e9f7d9075014147f50886216f6396e2f0
SHA512 96ce9c2f1314432bddc06b3969786a76060b671e3328633ec7bddb33a5f551c00142071f9115a908799a35d2dbb2dd97fefdd273d3a36c14c3bcf1f68decf66f
TLSH
T154C08C322D01F94338251D401DB4DA28300D02AF42CBAD8229862875588B8D9E6F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos2.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos2.bat
Size 172B
SHA256 4d1de34f5ff17494d91e0c2070e6c8a3dfae27ea16c2c1908d68b192ea56c1ac
MD5 61e2dd5d723f8bbef2e0d04ade62d3be
SHA1 7425ed302bcefd871b59e35bf8a768e02cc605e4
SHA512 e6083846cb3fdcacc005e163af9c518ba1606ece1426782e2cabdaf9be83869b0cdfb4b1c9c0377ea773108f35a48db54fb768d937a88a840805b7c3a08024cb
TLSH
T1CFC08C322D01F953291509401DE4AB78300D01AF42DB2D8128C624B2589B8DAF7BEA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos20.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos20.bat
Size 175B
SHA256 4d147343a4d200318431df4841b56dc4609eaa177feeb58389fe875db0a95815
MD5 827ca5aee8e2862d34fc6cbacd3c9116
SHA1 e78e2d3c439b3e68902dea3b1b801f81fefad6fd
SHA512 9f74b7c7257726d1899b0d60272ab34505918b1fe43a8a665cae4f4c89824e8e4d6fefc70b2f89c21dbfb583e0f19347bf5a7bdb8fe6973522a0dec7c7971844
TLSH
T178C08C312E01F9533825098C1DB5EA28B00F01AF82C36D81188A2872588F8DAFBBCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos21.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos21.bat
Size 175B
SHA256 6c00f9dd534b52e1c3ad9be37d551a59b8b422aef666d6f6cdbc76a6134e7e9c
MD5 05e30500511ae4116adbfb3f07d8a197
SHA1 b532410d540d74df9cb86d5fe9bce17061fb2b3b
SHA512 464d8262fddab8c787ce16cdf54da24e7087ebd0aaa46d67c5d4fceefef43f066046be2a6f778dca363a3b313339b6056855ad2be1420106a26517f5ac672cfd
TLSH
T1DDC08C312D01F963382509401EA4AA28700D01AF82C36E81188A2871988FCEAE7B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos22.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos22.bat
Size 175B
SHA256 2a7b30a47838041c8b61965c4d033a6a241d21c905c72dfda3ae9bf488b8b52e
MD5 dd93edfc1926ecaf9b775f947d89eb74
SHA1 acbdccaa34f7778e47c7b1ec4c8b82d6cdb82c6f
SHA512 d4d2fda8022ff67b03e4d6f8dc354e31d4eabf17be525caf55e463d6d78764c234024693f46277ee9db57f824f8680a93027cd0486b8a3dd546fa235c97dc08b
TLSH
T10DC08C322D02F993386509401DA4AA68700E01AF82D32D811C862872588F8DAE7BDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos23.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos23.bat
Size 175B
SHA256 8c2dbbcb36852abf050f40ec81658c539bc538f93b6907afe1aec05c75411205
MD5 500750c8d3077d9c3d57921eb653ef8d
SHA1 409a64fa4faef5789ac6843457ada78b3070d3f7
SHA512 0bae5a7ff0f11e40d8ad438967cd1bdd2fdba23cb6071043229f9b6c7007afd000eea39c0b8cedefd0d5094c5223077889a9d8f6489082f88bb492e9edc08275
TLSH
T148C08C316D01F953383509841DA6AA28700D41AF82C36D9A18876875588F8DAE7F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos24.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos24.bat
Size 175B
SHA256 a5361131f525f51dd27fe843e125d35104053fdde5cf4a6fe1a42eca4af9000c
MD5 d77810aa5130e3a75637f46d6cce87b3
SHA1 9217fc8739c19cc44712aaa51a47513c1806d2e8
SHA512 ac9f005705b0d39a58b6c1739a1ddff7f2dcd1f902e7b2c1f7a8778d6cbe21149ad39f8ab062e50b4e61fb21456f1db2ddca2da686fbd9e377f8cae8adcc3b4c
TLSH
T124C08C312D01FA5338290A401EA4AA38710D11AF82C32DD118862872698F8DAEBB8E21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos25.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos25.bat
Size 175B
SHA256 d4ac977470bab697360810b4696f9f13928d3b372466d43619968116d65b499a
MD5 6a35447fd1e6dc6f66c3c6835cb9ceed
SHA1 44a1a9080dd50ca893aa22fe12dcf92a3069bbd7
SHA512 ef13d58cd0b99b7c134e3f9aa0e81742e007ee980bb81d63aa9a040c4ae74e9cc9187df014e0438ef66db8d127536dd9e8e28bcad7661e8df9af01919d47f70f
TLSH
T128C08C313D01F953382609401EE4EA68720E01AF82C32DC1188628B1988F8EBE7BCA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos26.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos26.bat
Size 175B
SHA256 b5cceedd619e35c9e2308682e9b25887b715eae22c76b84a2ec9eb40171fa943
MD5 fa970462f7f2edf1deaa26ddf7579f2c
SHA1 eae251ae77875ed9d7bc4f71e83399d77fdca4eb
SHA512 9097f9ab7cddbb557638620e2782a3d00145864a1e4c587906ffeb29517b7e8cb8b5747d90c6cd93b308569860b51e4ea13e76ee9927e39d5a8dd375cd1f5b29
TLSH
T1F4C08C352D05F953382509401DB4AB28710D81AF82C3AE821A876871598F8DEE7B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos27.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos27.bat
Size 175B
SHA256 db2b044395bdb9111fbc42c490b14c80bc7b423452766c5e70d52c42b9ac4ab7
MD5 0e34687289b307df141661467d5fb656
SHA1 e7950fdbe0aad552705d1579e9bf11960303a688
SHA512 edf7d9cb759e66bc989a397f1fb9a5bb8d38f43b9c56c7921c23556a6c460a4a37d0b751677f52508254588297d4afe45ed3d0d59e3559e738bd7e1c5e5c04a1
TLSH
T1BEC08C313D01F953782509401DE4AA28760D05AF82C36D8128C628B1588F8DAE7B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos28.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos28.bat
Size 175B
SHA256 f5c199241617b2f4a3f429c3d8d237fcc9d7f9fbcd32ad03d32d57f823e2ca44
MD5 29634e14f199ade76f83e1428b8b481b
SHA1 8ef0d1c3108d3980bcd002283426883cc597b7cd
SHA512 11fd970301d9eecac9bb07714201f2c6a87d095845ba0ac11a429891fa807465584b7cfbdfbfa7decbada9b3fe447241b64ab92bb5cbd7cdbbcacdc0724e80ca
TLSH
T145C08C312F11F953382509442FB4AA28700D01AF83C32D81188B2871588F8DAEFB8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos29.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos29.bat
Size 175B
SHA256 3ba275592885691e3708f57181eb6ce45ee845f9845b4138d88470fd869ddfff
MD5 48539f83a12cb3ade98ff5937ae791d9
SHA1 35a92ac232e73f20311742494c7a0f59e2444662
SHA512 804435a12485dd471fa9de8a8fe4e4e7a50b1746d2d5f9dd9b5928e07433a7d31e832627ab5fb549dd25f6ac4dc4222b91b6d8486e949a78b2840153cba1915e
TLSH
T19CC08C313D01F95338651D401EB4EA28710D01AF82CB2D9218862875588FCDAE7B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos3.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos3.bat
Size 172B
SHA256 06073aa4473ce02ed95869bff34bfa63629b33e08c312e884f6bd583e83c32f5
MD5 a790ad32ed0e518a1100427a4bece251
SHA1 7933a77a2c8c29745c4f29d52eb2cc517b0ece88
SHA512 55c2aca2230a91ae027707b7c76a2e30e786465b559711c9abec44b0034337c0017e8d30f52152f21461b1d28b8fda2829449715d22f760dbc58e24cc60d6c00
TLSH
T1D8C08C312D01F953391509805DA59A28350D41AF52832D81288624B1589B8D9E6BDA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos30.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos30.bat
Size 175B
SHA256 fdfb53bc821d0f1a9e2aa6bf477525984191a9eaccba5a82f5983430fd2b28d8
MD5 85d3baf5d9e99947ae482a2323a6e95b
SHA1 9255a853c6dfd00278a0234e9d77409cd67e4681
SHA512 c14497bdfbc72843a4f4621d4517f82c537dc8276d7206fc9502fa158487c06a0bf6145e04f3010598be0ee899dc51192bb0d9fa9c34e0c394b91b440dd9a133
TLSH
T117C08C392D01F953382509881DB5D628354E01AF528B2D81188A2471588B8D9FABCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos31.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos31.bat
Size 175B
SHA256 6374c55978e413149d260d0ba7b015f23df06d299d3e294347c70be94be54636
MD5 a8022c4f39a3268411c56b3a5719d592
SHA1 bf622b63248f62cd87bb2b07951c9c9041b9c3f6
SHA512 386e766caa9e92114a260d9aaed40644b94719507896bc819ecae721a2b1d80da3a21491d2d8723d0a5d164d7e0c8539d5d7111dbcca7dd5d39771151123127f
TLSH
T126C08C312D01F9533C2509811EA49628350D01AF928B2E81188A247198CBCE9E6BCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos32.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos32.bat
Size 175B
SHA256 e1667244caae7c969da467b6c89886e2f3cfb03cee47a33a1c56f1394c7997fa
MD5 8efdf1717d52a8703d447c5eb4e35f11
SHA1 d4c753b69fad077ff598d7ad838b45d34ba93071
SHA512 86d7d436553be917bc68575f5089735121a02f61630bce6bf5d2712244ff15c49d7f3e6ee6808d5aa8961a0220799b2293679dca6ecf50c3db09b7b08b49c835
TLSH
T15EC08C322D01F99338650A801DA49668750E01EF52DB2D811C862471588B8D9E7BDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos33.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos33.bat
Size 175B
SHA256 1d0efb119ba5b585d3bdfeffbc58eb0eda57141ebdbb1f3ec291f9c963d24d76
MD5 9533a577f82a0cb0df5a9b7df5cb9871
SHA1 64eb42fd58ad6c92e766ef697bba01513f6ceaf0
SHA512 cb3e6789e8d680530ec6efd6c8f970c06f1ab26c03374bf107f07d66a9fbde0f0eb83ef492fe412d793946d0c7efcd20966e8cbc9692eb48328d9f04a97ac9bc
TLSH
T150C08C316D01F9533C3509841DA59628350D42AF928B6D911887247558CB8E9E6FCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos34.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos34.bat
Size 175B
SHA256 83ddc1ae0cac7b95192bfb9c03d42d35adc566808924231544a8a6b63bc6c37f
MD5 2fdb07330b1882eb77b8fcfa7f674ddc
SHA1 820cdec5d869f7091efc66a8a346e08429c34051
SHA512 38e058f7529bafcc5163b3566e8f427e51587171ab28612a447ed46c98cdd48adfb3320052c7955a3df7482024fd7fd68d59ee6a51d36378cd90d8d3dfca88fb
TLSH
T160C08C392D01FA53382909801EA4D628360D21AF528B6DD518862472688B8DAEABCE21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos35.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos35.bat
Size 175B
SHA256 b5adba40d2f00a73fca44c505d51e53d1906ebaf9375744496fbe14427f7cdf3
MD5 936bbb061eb86d409268a7ba9b3da92f
SHA1 02fe2ded4d09c3cfff3248aa7ba3349c6cf9c37f
SHA512 c10e08a291c14801289a96d17f029c57d3776ee9fe90973467c2bb2f8eb76a7f4b81b379b62e6fb963497e9e668e767afa210fc9ec4fc119f6291fc5e79a004f
TLSH
T10CC08C312D01F953382529801DA4E668360E01AF528B3DC1188624B5988B8E9E6BCAA4
MD5 SHA1 SHA512 TLSH

Submit Download

chaos36.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos36.bat
Size 175B
SHA256 27d1774dbde4b20434c44c68e896ac2f34a908520af75aeeb14a6ba133634b09
MD5 a7f9e099b58af72b2a7ed6ef5fe24cb9
SHA1 17fee2b0a3b124fb11d6f13a74f535c39e980684
SHA512 661711b2fc39f994682426b081e0133ff017423de6f1a3270a398cd262f50ba4f61b65612bf8bd68483a506fc7e22ae52c4c06eb6f70d2070a3da53e5a2bd394
TLSH
T12DC08C392D05F953382509801DB4E628750E81AF528BAD8218976471588B8D9E7BCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos37.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos37.bat
Size 175B
SHA256 22cea53220701c075d118c28169e9d8c5fa76cddd22df5230663e330bfef2f9f
MD5 eb544296eeddb9dfdd600dc06eadce1b
SHA1 8e9e7224ec97813aaec832ec2ff6cc1da8b4d7b6
SHA512 edf7f1fff4e3f519f21a133cdad35346a83b8234f21020bb8b8e0bea8f38c752b1dbd2edece07d84205fe24ab81cf0c28fb18e68de3b65b742ee0c5ea1766583
TLSH
T182C08C312D01F953382529801DE4A6283A0D01AF628B6D8128D62471588B8D9E6BCA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos38.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos38.bat
Size 175B
SHA256 053863dfbd88fe45f1ca17cac6cdced76720e2a8c8ba62387e6fa72df2df03d5
MD5 87dab786c8648bf911530f3fa267d3ce
SHA1 c383c4135d8add1ea1bf0db5a35a97d660e4c3a0
SHA512 9a8ac8b0be286bf67a42c0ba56082e5191b59bde5b7241d6252894cff6440982e40ecc5943dd30db46bcb0ae5dc1701c2016bbcd38331920e17c3eb47e525ec1
TLSH
T1B1C08C312E01F953382509842FB4A628350D01AF938B2D81188B6471688B8D9EFBCA25
MD5 SHA1 SHA512 TLSH

Submit Download

chaos39.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos39.bat
Size 175B
SHA256 3aed23d6f8075ebdd2d34efe41d85edfbacad30485239449749a156017291ede
MD5 a46c7df08ec8b45695952a913f1fe9bf
SHA1 cb3d02990aad280deab2ebd49c8c5363f5eeb27e
SHA512 28994b0356e9c73bf22183ad2cd638e4559588475b3c626eb8b2018ec57f5a97b3dbc039bfeec7e9a32748c02a6749bbc46d248ea963250ecaa786a06c3691ab
TLSH
T181C08C312D01F95338252D801DF4E628350D11AF52CF2D8218862475588B8D9E6BCAA0
MD5 SHA1 SHA512 TLSH

Submit Download

chaos4.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos4.bat
Size 172B
SHA256 a10afce56cf74171b41cc4b65aab9e8f2eeeca8b1e90424c6892ac40645a8a38
MD5 f7d0af8d67b25e59295137d4d0a8f10a
SHA1 a0ce726567624bab827e56a2215849cb53f32908
SHA512 51b7c9cdbb63773a7645538f75d08bded5bb80b1de161ed5c526aaa7d3f5ae485f908c14b4de6cd80ed600f084d0f4d1bfe18308cdeb6e2dfb2ad74b60f273e4
TLSH
T18BC08C322D01F953291509401EB49B68314D41AF43822D81288624B2699B8D9EAB9E34
MD5 SHA1 SHA512 TLSH

Submit Download

chaos40.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos40.bat
Size 175B
SHA256 9704f926d71ae6528af33b3e291ec18f397457aeaf3a90b49a7d6a86952d9b29
MD5 d63c049ae1292869664324f9ad5bee49
SHA1 ee600276520d85a6c57b0ecb4ba97b8de721447c
SHA512 3a274e3df1985905aa6a812ca18ab33d8d0b2563209420000b928012a314ccb7d3480166cbcbe8d80b5dd7b4ca7377b796cceacf5b69afdd1ef2a8097655d218
TLSH
T1A5C08C722D02F9532825094C1DB9DA68310E41AF42832D81588A2471598B8D9FABCE20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos41.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos41.bat
Size 175B
SHA256 e295c053588e30939dd359245f67c0ac2f85b5532fbd4e4479c9d785471fa6eb
MD5 3465c4807ced903c17fb5ab4cde4ee56
SHA1 da412b845f0c1e71c6c67b1c53ff232c3860d027
SHA512 975de1b3f04590175db99006037861c42e0342f698bdbefd8bf26f96dc9fc2bd6dc8b16b693170101fc5ad67b9161288a9bccd0c37408c7c5bd25ea0178235b9
TLSH
T1EAC08C326D02F95328250A401EA49A68300D41AF82832E81588A247299CFCE9E6B8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos42.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos42.bat
Size 175B
SHA256 88fde27c283709476186f1644ee2df9d2d66d609bc9bde77865fb7aca94b6b67
MD5 2cd765c07ddbbf872dcaba62f43c7bb5
SHA1 e61794a68bf670530cc0567aef56c7f55c19dece
SHA512 e3c80fab2d7ab5ac715be3031550b9e92c66f9fbedba1be74d1b219381823824795ed60c922a852eaed2c48c5bccb560a0fd975296e12dcac7fa0cae3ae9b8a2
TLSH
T154C08C322D02F993286509401DA89AA8300E81AF42932D815C866471598B8D9EBBDE60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos43.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos43.bat
Size 175B
SHA256 5445dc75df763a232d51b4ae790f25e07d96afcda669971c2a57ae9278704b25
MD5 132f1055d1a58ff4fae7224df0f1a7df
SHA1 09f0f65e36f1f8b30d262567a426716883ecd0af
SHA512 f63d219ea6e13eb82b82719b695270530b3a30044bb32225a7f657acde5d88b17be24ee7e046792ce96fad1d232ac6987e4408280641078a4c6bb912c8229614
TLSH
T141C08C32AD02F953387509845DA59A68310D81AF82836D91588724765A8B8D9E6F8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos44.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos44.bat
Size 175B
SHA256 7305a04e9ccb912cbfe0b1a6e19beed66d77a6bb468a56771bd0f552e91c3e26
MD5 c664c1c218d8b4dd069966c7b18b6b80
SHA1 127d1891558fe44799d72fd0f3494fd35e842db9
SHA512 70d320c07be0f9685f9b5571c4c3cccee72dafb505b46ba0973b43a6e70ce8c95e1a4c4a3660cf91abed93dcddc8c634ad8f13f83961fffac76cb58713993548
TLSH
T125C08C322D02FA53282909401FA49A68314D51AF42832DD158862472698B9EAEAB8E31
MD5 SHA1 SHA512 TLSH

Submit Download

chaos45.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos45.bat
Size 175B
SHA256 11b454adcb424c91af76f2ae8791f1889b5e7910d93f56c91ce4bea8167ad8c1
MD5 59bba6077973341e17b796327fce6f80
SHA1 1bcd08c11ddb1b6b85d09953cba2b51e4ff405db
SHA512 987a06dec4321fbea59171843a509319da041fbe80b5f3801dfc764010ce5633def3e1c818e2b449743f9ecc30f72ae95a7f25454559263001f52e777033b0d7
TLSH
T1F8C08C322E02FD53282509401DA4EAA8320E41EF42C72DC1588624B1998B8EAE6BCE60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos46.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos46.bat
Size 175B
SHA256 9e85b25ec9765a572b73c8eb4680c75234695e59004745ee53ffd9537726edbe
MD5 a415d82b5d8f6c549968304458b939a8
SHA1 0d93152a81de0de05a863f0b791a9ccaad8c16cb
SHA512 05220380b5d1f31849420edd7672750633eef735decad0af5474b0d6baaebc55875c1b43ea9b21c8947ed8b2b72ca43e613efa41de609ca345b5f12b0b1c2882
TLSH
T100C08C362D06F953282509401DB4AAA8300D91AF6283AD82588764715A8B8E9E6B8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos47.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos47.bat
Size 175B
SHA256 dda94c77083f35fe5f7ec9890fc14363f7b09156065825e54ad4cb7672078327
MD5 f66f0905fe878d9266c9f7463c68a407
SHA1 a27e29bd38ef5843d54b54619e076fe5701fe92b
SHA512 2110a4a5aeaf7066d6873e99fdc04bfdb25887da6d2bf45df2658709ebe019ed2197123d8e6c7eca05fe08a5ef116b6b3a44a91e03416be328d44b81425c88e6
TLSH
T174C08C362D02F953382509401DE49A6C360D55EF42936D8168C62471598B8D9EAB8E60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos48.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos48.bat
Size 175B
SHA256 48eba7824bc4bde3a39dda245d5296141974a1ce98df3783fc88ff66d78fe002
MD5 2cf0cdefac7c01428ad39f2c84083636
SHA1 e5cf91eaf4cd84bad4311bb7438981fd2c6a81fb
SHA512 a905b2d2f3629892f35523e244b57899eccb501937b668c6a94bcca380403081517e20d966924a4c03dced26728156bdf9ea26656e64865c83c46c2315aee946
TLSH
T182C08C323E02F953282509442FB4AA68300D41AF83832D81988F2471598B8D9EEB8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos49.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos49.bat
Size 175B
SHA256 d8028a000a9a86904540674674dbd903db21116090bec795ec8e2adcb9eaf445
MD5 301be79a62fdfb50e495808d82bf53bc
SHA1 be7e835dbed67124a8eabfe30f0196b9d7d69ff0
SHA512 591f625cbc389125a5b321813e3bcbcee78035fc4c5c14289de228b85ce4fc7de37cc73079dc96c3359f1c5e980888326834df903c45e9b11692ba5261014c83
TLSH
T1D4C08C322D02F95329251D401EB4DA78300D41AF52CB3D8258A66475598B8D9E6BCE20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos5.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos5.bat
Size 12B
SHA256 5822c2222c4a4121a1667c7d483ff8b91e489a4c5e881c75a4354712bfe6f435
MD5 eeb086a7854dae6cdce64f49eb87d64c
SHA1 82a3a261651432b1b3e29d7d8def566b1b18cf2a
SHA512 3d38272520b97022539d93e206a58c3398ccf30758eef2d31a976a8cb84686f37cc2729efa9d49ad85bd3590ab5baec071772b8eaa2c82db3443a189329cc431
MD5 SHA1 SHA512

Submit Download

chaos5.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos5.bat
Size 172B
SHA256 fdd488ffb76bb563b1feb2ead7c6c055ffe385a2349121eebb2dff6a840255d4
MD5 e75b9708f57c6634150679d3cd911764
SHA1 bd0fcaa237191188f36fd70a91c8685d84d418c2
SHA512 8fb9c4cf92f004e6f22184c2e2d73a1bfa20725272ffe04dc44c8aea845c958290c3c5e52a5a8520e30902a2e2f5a31649b41840ef85fe73c3418000585e8d7b
TLSH
T119C08C312D09FA43291509441EB4DA28320E01AF42822DD1289624B1589B8D9E7BEA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos50.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos50.bat
Size 175B
SHA256 0df548b76e6b2efa789122e87fb7e6a7ad55dec263b03f2b08aac39d1dbb069e
MD5 d837556675de2a0884e620467d980fed
SHA1 8c744e1f33b2011533604fa0fb09ec9d0e02db2e
SHA512 7c73392a8b94c7bebbdc8ba1e8536e1e81dfcd011e8ba1b53a59acea500a4b4451642541bc9500c78f12afb3574be9af55075baaa7c20ff516f2bf784aca3a9d
TLSH
T1F2C08C352D09FA433C25094C1EB9D628300E01AF43832DA1188A2475588B8DAFBBDA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos51.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos51.bat
Size 175B
SHA256 e42ac8194f0e1974ec6b9f204c6caaad3343adf098867fe23a3be8fc6e6a9a2f
MD5 d27274690d0b6d1693d7fe721a698f6d
SHA1 a6b83023598675ef68cb71f95fc1fd442cd5a2d6
SHA512 5cdf04e27c9a20ea2ce8086ac89c97c005de34b76f185c96c5e13d2c96957b68c6407febfdedc20bdaaae553b22afbb41819fddefc6ab713a46e4591576c0d01
TLSH
T148C08C352E09FA433C2509441EA4D628300D01AF83833E81188E2471988BCE9E7BDA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos52.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos52.bat
Size 175B
SHA256 d3efd62cf1c5cc1e0b0f1a5041f5b00d114e40b19c7598972a19dce66757d742
MD5 24dcdfdb91fd07ff60f7800ee0c149ab
SHA1 93ea266d1ce99133fb7ffc49916a3dc44c8bef5e
SHA512 8b8ff1d5fb420ad69ba5ae66eac1537254b6ec1f6b4c78fe6a357dc686a9be2e0d3f79251ed6a77fbdd452fb37b53ff77060e357062486d20d7a1dd841f14458
TLSH
T159C08C362D09FA833C6509441EA4D668300E01AF43932D811C862471588B8D9E7BEA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos53.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos53.bat
Size 175B
SHA256 245f668fe72b2af97e79f9d5e30717ac445aafd4b93079b2113137b089378cf5
MD5 bd9fcbce169c4e33b5a5a23546d21280
SHA1 5ad25afb7c5753a5842e2661ed25ab600599376a
SHA512 9ea997eff5c2e2f8531aa41c4f4adec54a26502699d63b69fb3e94a6e26e6ae7fa62b0382f1da101e58f4e699855d3ec35c16e9a824965cf06ecbed0fe255a5e
TLSH
T101C08C36AD09FA433C3519881EA5D628300D41AF83836D91189B2479598B8D9E7F9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos54.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos54.bat
Size 175B
SHA256 8e2d0e9d9e74d28f15af2c73ebaa49da5e47c3c341d3d283f1990e848472843a
MD5 e3fc6da63aa3f06ae14109053c0a1655
SHA1 24e33375ff863b47491a90223faec243cc7e8dc4
SHA512 1860e4beeba19bc694771a5d75708a293e56172dc6c7ca64892c69676ac89fd605bb2f8a2eb95fa11028ce829643475acd00ab1c6c117219312327e8ec9dce75
TLSH
T11AC08C352D09FA433C290A441EA4DA28310D11AF43832DD118862472688B8DAEBB9E21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos55.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos55.bat
Size 175B
SHA256 289c73643bb9dbbce154e6957acb10a77e5dbf1f78e8454a4456fd2a71f5ca56
MD5 d54d39d341f14a637e849aa17f7447e3
SHA1 9006b16471b8639b1a622b442af7453eaa9c6052
SHA512 52b763cd02db51a8ecd720ec2004562bbcf5c8b6b9992ea9213fa77052c7a47e9fb2db75303ceab0a9d21e376641944bf3cdb16f82d771510abd57184cfd92b6
TLSH
T19FC08C352D09FA433C3509441EA4E668320E01AF43832EC1188624B1A88B8E9F7BDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos56.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos56.bat
Size 175B
SHA256 ac2263bfec87d57d8f9384a2b8e8e35c3304ffdbe8784142b4e379a056b70fe5
MD5 4aa2b7d0ebe8085baa4b340525334b22
SHA1 85bec73d57f20c21ab8073ab16f460bc1fbcceec
SHA512 8bccc8bbc95ecbe926c7a00fd078474e7fae21ae108da4c4816bbd45a292f04ed1d8c0145be59a5700fbec91f8e61348ab90a01bc7c34e13f5322084b9247a0c
TLSH
T119C08C392D0DFA433C2509841EB4E628300D82AF4383AD8218876471688BCD9EBB9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos57.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos57.bat
Size 175B
SHA256 66dbbcf3ed3cfcdccfd5de9faf9afe9a5b95035449ad07c15fc6ec1e8cb49af3
MD5 b2aaace95221a826a9e06eb74e9aa57d
SHA1 97e6a9d4e0db3e7e0e479ca99996eb8314b5cf7b
SHA512 8f33c7a37e9ad7cb4e61834b05eea308c1bd47f10e378014808e3b85cc9dca05d76a13e06f69c5c3e54e0ca5d8fbb47b9071af991bb8c1482fc1116830dd74f4
TLSH
T1BBC08C362D09FA433C290D441EE4D628360D01AF43836D8128C62471598B8D9E7B9EA0
MD5 SHA1 SHA512 TLSH

Submit Download

chaos58.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos58.bat
Size 175B
SHA256 a308e33461a3b7f1f5f3cf4933301e851113c1760f2b29ba08e6083fd36aaa14
MD5 dce50a9ef806aa70f056bc832c137bd1
SHA1 c8ee1ce9f8c5261bee1d918a7ba3ebb92f9075a8
SHA512 d64b16a3f6af8ecf89f1a47aa46be2dbee200ca4a3184c61f7fedfacf4dd55e0a3b4c51879dbbcfced372554ea85b1495bdd91e3b76df2e5b64ab1a0475cba8b
TLSH
T11BC08C352E0DFA433C2509482FB4E628300E01AF83832D81188B2471588B8D9EFB9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos59.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos59.bat
Size 175B
SHA256 e0ac691ce96913f62dd4e0697f051bfe2f0387eff334844d1e3ef1ffc4ceea36
MD5 c20a4be9a607faae6c8a50c879bfc094
SHA1 486d8a15169dd99a1c0ebd75f6494f2346bdb2b0
SHA512 181181c30c109a55288b9a9a6e8110ad1a49a35215de53f9a4b967a892a4cc21cfece4b837ab4f5f81b7355b541f721195a20d7a5d4e3e17f69fd4beae073b20
TLSH
T1F4C08C356D09FA433C251D441EB4D628300D02AF43CB2D821886247558CB8D9E7B9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos6.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos6.bat
Size 172B
SHA256 d844ea91f25fb8628b5934ae3abbbc8e20f082a9b4d5fa08d6b4e9cb6f8a1b1c
MD5 676f7bce2f17661718cc8f06e7a5ffde
SHA1 1bec6b7f0c476e194c27a73733d2af0c4fa674a2
SHA512 2e7d534cbc30069d1884c69ae82df683214a98046d160f062513d430135c7a94421be870e0ebb3ddf96dcb991b094a3a086e97b2c1e06ccbd9eb5aa8cab5663a
TLSH
T14CC08C352E11F943291509441DA49A28300D01AF4282AD82288764B2589B8DAE6B9E60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos60.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos60.bat
Size 175B
SHA256 0d93dac8f5608a90011fb32569eba3912c1cf49d27a921f1dd8db81d80244973
MD5 b181f0353240d57eb3a4888b6eb0b55f
SHA1 99e781dd212666d0674f329f7d2041ccaa22f8d4
SHA512 f574a000bfa6933664d1ba60665b6e62132eb2ae10edf46c5b329b1dc5b6d418ab5b30c1ed58809a64dccd138757fa8b7b4f8bcd1156cfaa7abf3d3383db0123
TLSH
T1F3C08C312D01F9532826294D1DB5D728300E02AF42832D85188E2472588B8DAFABCE20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos66.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos66.bat
Size 175B
SHA256 bda1322d7eef2a29c141620b27eec3d36c1ecb9e8c4b94bddc8d92db270a0508
MD5 ee5d57965ebc7aeab595dad687bec8bd
SHA1 8f611e624489be890c9f809d30616971bcf6dbed
SHA512 7e10dae9dd9375d0bf38b56d6c56bd8e1b02e0b931bea5c8e1310014faf84dc9da1f1f49b5efc6329c9b7728d7906d74d619fb983d6cbbc76e768cf7a76c8ef4
TLSH
T1ADC08C352D05F953282629801DB4A628300D81AF4283AD8218AB6472588B8DAE6B8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos7.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos7.bat
Size 172B
SHA256 753bb2aae2707de5c07c1575f6ed45bb77d7cf3338ba21c2e6ed2a079300db6d
MD5 b71aff09e2aeb11272aee832e644b98c
SHA1 aa3ab03b27696ade001e1ebf51cdda54dd5b5b83
SHA512 1d6b9060e24e8fc8d3e0f04ec9884c57cf8e8d6643bd34d236263947d72e1601a0cd9ff72330aa1bf38b14e984e5d91246228c224de6c805483501649db27b3c
TLSH
T1ABC08C312D05FD532A2509402DA49A38300D01AF42822D82388624B1589B9D9E6B9A64
MD5 SHA1 SHA512 TLSH

Submit Download

chaos77.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos77.bat
Size 175B
SHA256 52fa9314ed2382f9efbc8741965138e7f1562806730a8c5ba0d02e23e0edd36c
MD5 a564881d6604b484b840f2b5f9291cc6
SHA1 499d5e17daebd5d9cc979a8942b7c880eaec5904
SHA512 8a7ea0d7e319ebcda601fe56dc4b9d130ae1c32b68d76edfff2658e5b4ed38f678622a84a100fe7de5f3595168865327be6b8b7a4dd430b4fa29270b1f024093
TLSH
T1A8C08C312D29F953382519401DE49628360D21AF42836D826AD664B1588BAD9E6B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos8.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos8.bat
Size 172B
SHA256 e1e1575f0fb25e9330a9c6bcb3f8ffc380f1c44b18f757d3df2bcfc764738295
MD5 d3bc0537c76f4dd63f581269ce9248e3
SHA1 1010fc194217661191a55636276c191196d9c6b7
SHA512 5affed1cffd77bcda2c33329b56d09ac382b027a76aa6ecd4119d6472f210c04b236876c184c741f1bee46ed375acb97665efbfa4da2a38917ba0172faf90036
TLSH
T18DC08C312E01F94329150D502EB49A28300D01BF83832D81289B24B158DB8D9FAB9A24
MD5 SHA1 SHA512 TLSH

Submit Download

chaos84.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos84.bat
Size 175B
SHA256 dd26eba993f153e3578ab9629f648776b7fd3af2e3387130246a39d5ca3e887a
MD5 c4185a4dacb180e49aae0ea4b3ee9b12
SHA1 4d6b8888943dbca9ba11d638c8dfff5153af1811
SHA512 160298ad91525d36f188c20c89e2e59e0ace8897b6e83236d4c51b99d041afb57452fe6c156573aaccc1c5c585e6d2ca5da65b48b84644738a00e0efb521d4bb
TLSH
T10CC080351D05F543281609401D649514310D116F41833DD11496147254878DBFFB8D11
MD5 SHA1 SHA512 TLSH

Submit Download

chaos86.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos86.bat
Size 175B
SHA256 435ae800f41c540efc0540b414457eac448ff44cc6e9e0c801742a87d4c30664
MD5 729b101de7063ce831fe16529f2da04b
SHA1 a9d82fe6482694d8d726463600b993de5e832339
SHA512 7d41a66c6ea0a9714cc21cb306a2f945e1946d9d3feef4e2561ec0273fe0d1cb998527f7ceb78a5feb59dee6d9ad28f01cf45653e5ea5ce5b72b195ff8ec178f
TLSH
T1F4C08C392D09F9432C2609402DB8E728300D81AF4283AD82289774B1588B8DAF6B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos9.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos9.bat
Size 172B
SHA256 1a3dc930e3b39ab5f676440721f4673e6865e952a3654ea3e9de8fe0c51da33d
MD5 57d012552a263efb0d37f567fb1b9100
SHA1 d9b77c34596ee0be9c2fd815481e6a54b95f7afe
SHA512 1f6d272d44c857753ea281fa67a1c7439cbcff66ff3f5dcee98763a202cf493ec8eed6af42da0491ab82955a20ee26bd301fa902d7458a507ad86162f94231d1
TLSH
T10FC08C312D01F9432A1609401DB4DA29300D01AF42C62D813C86A4B5589B8D9E6BEA20
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6580-1175-0x0000021493190000-0x000002149319C000-memory.dmp

Download

memory/6580-1174-0x0000021491400000-0x0000021491755000-memory.dmp

Download

memory/9708-1048-0x00007FFFB21C0000-0x00007FFFB225E000-memory.dmp

Download

memory/10164-1154-0x00007FF670270000-0x00007FF6702D7000-memory.dmp

Download

memory/12436-1135-0x0000019915150000-0x00000199154A5000-memory.dmp

Download

memory/13236-1136-0x000002613E1A0000-0x000002613E4F5000-memory.dmp

Download

memory/14424-1164-0x000001C3F7260000-0x000001C3F726C000-memory.dmp

Download

memory/14424-1163-0x000001C3F4770000-0x000001C3F4AC5000-memory.dmp

Download

memory/15492-1167-0x0000024871AF0000-0x0000024871AFC000-memory.dmp

Download

memory/15492-1166-0x000002486F570000-0x000002486F8C5000-memory.dmp

Download

memory/15784-1152-0x00007FF670270000-0x00007FF6702D7000-memory.dmp

Download