8239006e0b4296c0003ebf8a8955d40e7cb751efbcbf6e98490f76ca89bb4538

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/03/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.bat
Size 1KB
Sample260322-ypbzesfs4w
SHA256 8239006e0b4296c0003ebf8a8955d40e7cb751efbcbf6e98490f76ca89bb4538
MD5 9c09ea8c84e71612faaa6471b0a971f8
SHA1 ee966616bc8ecff690707762f63b682336987070
SHA512 c0e21616eff796772be507c33a80a55cc15f330ef7a8bec5ed7902a318a2597e8bfbdc36f7b1af1720fb897b414240e24f10727714675f83b2839ba3c55b890a
TLSH
T1E42151A7B701F413ABA4CA81C45EBD08FD0A715F9ED0AD97B45A542E4D1BCE1B1DC840
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
15060	PING.EXE
25204	PING.EXE
16372	PING.EXE
18576	PING.EXE
9652	Process not Found
13308	PING.EXE
20628	PING.EXE
1012	PING.EXE
19476	PING.EXE
9684	PING.EXE
6740	PING.EXE
20804	PING.EXE
5288	PING.EXE
26388	PING.EXE
1360	PING.EXE
9704	PING.EXE
7988	PING.EXE
14564	PING.EXE
17976	PING.EXE
20516	PING.EXE
23824	PING.EXE
9768	PING.EXE
8508	PING.EXE
15372	PING.EXE
21572	PING.EXE
5708	PING.EXE
8832	PING.EXE
23812	PING.EXE
15188	PING.EXE
27088	Process not Found
28412	Process not Found
28068	Process not Found
27764	Process not Found
11772	PING.EXE
13100	PING.EXE
11408	PING.EXE
16640	Process not Found
28428	Process not Found
7760	PING.EXE
6460	PING.EXE
17908	PING.EXE
2956	PING.EXE
9648	PING.EXE
22832	PING.EXE
20816	Process not Found
15852	PING.EXE
7388	PING.EXE
11140	PING.EXE
5416	PING.EXE
18392	PING.EXE
16956	PING.EXE
22652	PING.EXE
12600	PING.EXE
20952	PING.EXE
17508	Process not Found
28244	Process not Found
7624	PING.EXE
19636	PING.EXE
4584	PING.EXE
13192	Process not Found
25632	Process not Found
22316	PING.EXE
12104	PING.EXE
13012	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
12396	msedge.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
11572	PING.EXE
12104	PING.EXE
8376	PING.EXE
17028	PING.EXE
23812	PING.EXE
9832	PING.EXE
6740	PING.EXE
16804	PING.EXE
17216	PING.EXE
9652	Process not Found
9648	PING.EXE
7616	Process not Found
9996	PING.EXE
7852	PING.EXE
19984	PING.EXE
20120	PING.EXE
4496	PING.EXE
20804	PING.EXE
13864	PING.EXE
5288	PING.EXE
6696	PING.EXE
8060	PING.EXE
5708	PING.EXE
14456	PING.EXE
9480	PING.EXE
8976	PING.EXE
16284	PING.EXE
15688	PING.EXE
5760	PING.EXE
22012	PING.EXE
26992	PING.EXE
27248	PING.EXE
4980	PING.EXE
13692	PING.EXE
18404	PING.EXE
7992	PING.EXE
10760	PING.EXE
21924	PING.EXE
26724	Process not Found
7592	PING.EXE
12480	PING.EXE
12596	PING.EXE
8220	PING.EXE
10652	PING.EXE
17424	PING.EXE
25632	PING.EXE
27848	Process not Found
18876	Process not Found
13028	Process not Found
8208	PING.EXE
10256	PING.EXE
13116	PING.EXE
14628	PING.EXE
13628	PING.EXE
5636	PING.EXE
8692	PING.EXE
11632	PING.EXE
18392	PING.EXE
26152	Process not Found
6708	PING.EXE
5792	PING.EXE
12700	PING.EXE
11496	PING.EXE
19560	PING.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3544	4720	cmd.exe	80
PID 4720 wrote to memory of 4236	4720	cmd.exe	81
PID 4720 wrote to memory of 4660	4720	cmd.exe	84
PID 4720 wrote to memory of 3360	4720	cmd.exe	86
PID 4720 wrote to memory of 4448	4720	cmd.exe	87
PID 4720 wrote to memory of 4640	4720	cmd.exe	88
PID 4720 wrote to memory of 4396	4720	cmd.exe	89
PID 4720 wrote to memory of 2332	4720	cmd.exe	90
PID 4720 wrote to memory of 1680	4720	cmd.exe	91
PID 4720 wrote to memory of 4204	4720	cmd.exe	92
PID 4720 wrote to memory of 4452	4720	cmd.exe	100
PID 4720 wrote to memory of 1888	4720	cmd.exe	102
PID 4720 wrote to memory of 1816	4720	cmd.exe	103
PID 4720 wrote to memory of 3056	4720	cmd.exe	106
PID 4720 wrote to memory of 3224	4720	cmd.exe	107
PID 4720 wrote to memory of 2504	4720	cmd.exe	108
PID 4720 wrote to memory of 3392	4720	cmd.exe	110
PID 4720 wrote to memory of 2972	4720	cmd.exe	114
PID 4720 wrote to memory of 4344	4720	cmd.exe	116
PID 4720 wrote to memory of 1380	4720	cmd.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos1.bat
  2⤵
  PID:3544
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:4092
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos1.bat
    3⤵
    PID:7176
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13756
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos1.bat
      4⤵
      PID:17180
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:19528
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:19580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos1.bat
        5⤵
        
        PID:7688
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:22012
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:26328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos1.bat
        6⤵
        
        PID:26452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos2.bat
  2⤵
  PID:4236
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8376
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos2.bat
    3⤵
    PID:10560
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:11040
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos2.bat
      4⤵
      PID:14120
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:11924
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:18928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos2.bat
        5⤵
        
        PID:16048
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:22604
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:26360
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos2.bat
        6⤵
        
        PID:26368
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:23792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos3.bat
  2⤵
  PID:4660
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:4980
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos3.bat
    3⤵
    PID:4588
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:14404
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos3.bat
      4⤵
      PID:18132
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:8832
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:14672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos3.bat
        5⤵
        
        PID:23652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos4.bat
  2⤵
  PID:3360
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9012
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos4.bat
    3⤵
    PID:11336
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:17916
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:20852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos4.bat
      4⤵
      PID:20860
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:23344
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:17120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos4.bat
        5⤵
        
        PID:7068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos5.bat
  2⤵
  PID:4448
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9768
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos5.bat
    3⤵
    PID:11904
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:12480
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:16916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos5.bat
      4⤵
      PID:16924
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21896
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos5.bat
        5⤵
        
        PID:20628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos6.bat
  2⤵
  PID:4640
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:6276
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos6.bat
    3⤵
    PID:8968
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:9616
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos6.bat
      4⤵
      PID:14256
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:20268
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos6.bat
        5⤵
        
        PID:19636
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:11144
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:21732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos7.bat
  2⤵
  PID:4396
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:10760
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos7.bat
    3⤵
    PID:16792
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:24512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos8.bat
  2⤵
  PID:2332
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1360
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos8.bat
    3⤵
    PID:8804
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:6516
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:10384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos8.bat
      4⤵
      PID:10392
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:10880
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:14096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos8.bat
        5⤵
        
        PID:14104
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:14604
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:18612
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos8.bat
        6⤵
        
        PID:18620
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:13540
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:11136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos8.bat
        7⤵
        
        PID:26900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos9.bat
  2⤵
  PID:1680
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:5792
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos9.bat
    3⤵
    PID:8236
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13212
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos9.bat
      4⤵
      PID:18016
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:24296
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:16660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos9.bat
        5⤵
        
        PID:12228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos10.bat
  2⤵
  PID:4204
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7080
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos10.bat
    3⤵
    PID:8944
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15912
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos10.bat
      4⤵
      PID:18900
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:20804
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:20996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos10.bat
        5⤵
        
        PID:5680
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:15060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos11.bat
  2⤵
  PID:4452
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:7992
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos11.bat
    3⤵
    PID:11596
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:17692
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos11.bat
      4⤵
      PID:16528
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:11104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos12.bat
  2⤵
  PID:1888
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9292
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos12.bat
    3⤵
    PID:11944
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15096
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos12.bat
      4⤵
      PID:16404
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos13.bat
  2⤵
  PID:1816
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:2408
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos13.bat
    3⤵
    PID:8052
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:7780
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos13.bat
      4⤵
      PID:11288
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21668
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos13.bat
        5⤵
        
        PID:23432
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1012
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:22692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos13.bat
        6⤵
        
        PID:21164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos14.bat
  2⤵
  PID:3056
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:10652
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos14.bat
    3⤵
    PID:14064
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:17028
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos14.bat
      4⤵
      PID:19148
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:20120
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos14.bat
        5⤵
        
        PID:5496
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:19476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos15.bat
  2⤵
  PID:3224
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8992
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos15.bat
    3⤵
    PID:9104
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:14564
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos15.bat
      4⤵
      PID:17896
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:19416
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos15.bat
        5⤵
        
        PID:8020
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:22652
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:25384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos15.bat
        6⤵
        
        PID:25392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos16.bat
  2⤵
  PID:2504
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8508
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos16.bat
    3⤵
    PID:8572
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:15688
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos16.bat
      4⤵
      PID:19772
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21740
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos16.bat
        5⤵
        
        PID:11272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos17.bat
  2⤵
  PID:3392
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:11272
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:18296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos17.bat
    3⤵
    PID:18540
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:12484
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:10640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos17.bat
      4⤵
      PID:10444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos18.bat
  2⤵
  PID:2972
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:11344
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos18.bat
    3⤵
    PID:17148
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13084
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:20024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos18.bat
      4⤵
      PID:20032
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5288
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:21736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos18.bat
        5⤵
        
        PID:13132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos19.bat
  2⤵
  PID:4344
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8060
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos19.bat
    3⤵
    PID:9608
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:14888
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos19.bat
      4⤵
      PID:19708
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:5248
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:23708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos19.bat
        5⤵
        
        PID:23192
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:23148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos20.bat
  2⤵
  PID:1380
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:11364
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos20.bat
    3⤵
    PID:14800
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:17216
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:3928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos20.bat
      4⤵
      PID:8096
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:7884
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:19016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos20.bat
        5⤵
        
        PID:24408
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:26736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos21.bat
  2⤵
  PID:4924
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8976
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos21.bat
    3⤵
    PID:10340
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:20144
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos21.bat
      4⤵
      PID:9228
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:27004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos22.bat
  2⤵
  PID:4184
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8072
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:17184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos22.bat
    3⤵
    PID:17636
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:8576
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:8732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos22.bat
      4⤵
      PID:23056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos23.bat
  2⤵
  PID:4664
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:10256
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos23.bat
    3⤵
    PID:10104
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13532
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos23.bat
      4⤵
      PID:18316
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:25616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos24.bat
  2⤵
  PID:1608
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:6516
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos24.bat
    3⤵
    PID:8712
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:17192
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:20764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos24.bat
      4⤵
      PID:20580
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:16512
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:22000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos24.bat
        5⤵
        
        PID:7640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos25.bat
  2⤵
  PID:1928
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:6696
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos25.bat
    3⤵
    PID:8376
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13084
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:23360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos25.bat
      4⤵
      PID:7732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos26.bat
  2⤵
  PID:3920
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7624
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos26.bat
    3⤵
    PID:5796
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10060
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos26.bat
      4⤵
      PID:12132
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:16148
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:19256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos26.bat
        5⤵
        
        PID:19272
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:21496
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:23312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos26.bat
        6⤵
        
        PID:23468
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:26388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos27.bat
  2⤵
  PID:3408
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9704
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos27.bat
    3⤵
    PID:12052
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15692
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos27.bat
      4⤵
      PID:21112
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:6708
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:24084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos27.bat
        5⤵
        
        PID:24092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos28.bat
  2⤵
  PID:1120
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6460
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos28.bat
    3⤵
    PID:8860
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10944
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos28.bat
      4⤵
      PID:12704
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:22832
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:13452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos28.bat
        5⤵
        
        PID:10732
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:25204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos29.bat
  2⤵
  PID:460
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9480
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:17560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos29.bat
    3⤵
    PID:17664
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:7788
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:27068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos29.bat
      4⤵
      PID:27076
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:27472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos30.bat
  2⤵
  PID:960
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:5780
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos30.bat
    3⤵
    PID:8364
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:14848
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos30.bat
      4⤵
      PID:19992
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21448
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos30.bat
        5⤵
        
        PID:23420
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:25760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos31.bat
  2⤵
  PID:4684
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8064
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos31.bat
    3⤵
    PID:8796
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:18760
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:22856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos31.bat
      4⤵
      PID:9188
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:25656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos32.bat
  2⤵
  PID:3312
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:10072
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos32.bat
    3⤵
    PID:12156
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:12816
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:20332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos32.bat
      4⤵
      PID:20340
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:4572
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos32.bat
        5⤵
        
        PID:24060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos33.bat
  2⤵
  PID:4920
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8540
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos33.bat
    3⤵
    PID:9052
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:11156
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos33.bat
      4⤵
      PID:12972
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:19940
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos33.bat
        5⤵
        
        PID:20044
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:23836
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:19468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos33.bat
        6⤵
        
        PID:19792
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:26568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos34.bat
  2⤵
  PID:4724
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:10916
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos34.bat
    3⤵
    PID:13000
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:11500
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:20964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos34.bat
      4⤵
      PID:23164
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:23796
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:22828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos34.bat
        5⤵
        
        PID:17592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos35.bat
  2⤵
  PID:4320
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5416
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos35.bat
    3⤵
    PID:9160
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:15372
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos35.bat
      4⤵
      PID:13856
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21512
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos35.bat
        5⤵
        
        PID:22840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos36.bat
  2⤵
  PID:2880
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:6596
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos36.bat
    3⤵
    PID:9028
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:9996
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:16056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos36.bat
      4⤵
      PID:16072
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:20516
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:23976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos36.bat
        5⤵
        
        PID:24536
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:26992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos37.bat
  2⤵
  PID:4356
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8068
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos37.bat
    3⤵
    PID:9244
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10944
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:13404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos37.bat
      4⤵
      PID:13412
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:16476
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:19104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos37.bat
        5⤵
        
        PID:19116
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:7536
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:24364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos37.bat
        6⤵
        
        PID:24444
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:25204
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:26968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos37.bat
        7⤵
        
        PID:26980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos38.bat
  2⤵
  PID:2996
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7204
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos38.bat
    3⤵
    PID:9196
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:17740
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos38.bat
      4⤵
      PID:21072
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:24036
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:18556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos38.bat
        5⤵
        
        PID:11032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos39.bat
  2⤵
  PID:4568
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:11496
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos39.bat
    3⤵
    PID:16996
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15264
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:25232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos39.bat
      4⤵
      PID:17076
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:17424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos40.bat
  2⤵
  PID:3440
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:11160
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:20224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos40.bat
    3⤵
    PID:20744
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:26248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos41.bat
  2⤵
  PID:4072
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:10644
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos41.bat
    3⤵
    PID:13244
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:17976
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos41.bat
      4⤵
      PID:8896
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:19636
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:10128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos41.bat
        5⤵
        
        PID:12716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos42.bat
  2⤵
  PID:2820
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7624
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos42.bat
    3⤵
    PID:15400
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:20576
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:26008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos42.bat
      4⤵
      PID:26016
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:9960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos43.bat
  2⤵
  PID:3864
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:12404
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos43.bat
    3⤵
    PID:13216
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:14464
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:23592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos43.bat
      4⤵
      PID:23672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos44.bat
  2⤵
  PID:3348
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:12600
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:17828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos44.bat
    3⤵
    PID:17836
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:21280
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:23176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos44.bat
      4⤵
      PID:10796
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:17244
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:27324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos44.bat
        5⤵
        
        PID:21708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos45.bat
  2⤵
  PID:4876
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7388
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos45.bat
    3⤵
    PID:19264
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:23824
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos45.bat
      4⤵
      PID:20300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos46.bat
  2⤵
  PID:2840
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9532
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos46.bat
    3⤵
    PID:11156
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:21196
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:23492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos46.bat
      4⤵
      PID:10152
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:24272
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:16460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos46.bat
        5⤵
        
        PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos47.bat
  2⤵
  PID:2496
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:11572
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos47.bat
    3⤵
    PID:15556
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:16284
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos47.bat
      4⤵
      PID:20072
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:23932
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:16820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos47.bat
        5⤵
        
        PID:17104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos48.bat
  2⤵
  PID:4000
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7988
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos48.bat
    3⤵
    PID:9260
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:12700
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos48.bat
      4⤵
      PID:17820
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:17432
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:20880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos48.bat
        5⤵
        
        PID:17928
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:7160
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:25588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos48.bat
        6⤵
        
        PID:6948
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:19332
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:13060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos49.bat
  2⤵
  PID:4064
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:540
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos49.bat
    3⤵
    PID:12272
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13096
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:13776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos49.bat
      4⤵
      PID:20140
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:10272
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos49.bat
        5⤵
        
        PID:5512
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:20200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos50.bat
  2⤵
  PID:2964
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:11232
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos50.bat
    3⤵
    PID:15064
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:21924
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:20740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos50.bat
      4⤵
      PID:24388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos51.bat
  2⤵
  PID:2548
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7856
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos51.bat
    3⤵
    PID:11004
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:20556
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos51.bat
      4⤵
      PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos52.bat
  2⤵
  PID:2684
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:13116
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:17784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos52.bat
    3⤵
    PID:18520
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:16088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos53.bat
  2⤵
  PID:4668
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:7852
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:17400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos53.bat
    3⤵
    PID:13100
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:13628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos54.bat
  2⤵
  PID:432
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:9832
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos54.bat
    3⤵
    PID:12112
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:16640
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos54.bat
      4⤵
      PID:19304
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:4496
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:23008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos54.bat
        5⤵
        
        PID:23548
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:27248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos55.bat
  2⤵
  PID:1044
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:13220
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos55.bat
    3⤵
    PID:12764
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:19560
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:7708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos55.bat
      4⤵
      PID:21452
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21688
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:26024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos55.bat
        5⤵
        
        PID:26032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos56.bat
  2⤵
  PID:4848
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:13108
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:18564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos56.bat
    3⤵
    PID:19544
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:5448
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos56.bat
      4⤵
      PID:22556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos57.bat
  2⤵
  PID:4484
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:13084
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos57.bat
    3⤵
    PID:18216
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:20804
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos57.bat
      4⤵
      PID:20152
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:22664
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos57.bat
        5⤵
        
        PID:8688
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:17536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos58.bat
  2⤵
  PID:3956
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:13092
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos58.bat
    3⤵
    PID:7852
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:1376
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:26712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos58.bat
      4⤵
      PID:26788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos59.bat
  2⤵
  PID:5124
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:13012
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos59.bat
    3⤵
    PID:16516
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:17748
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos59.bat
      4⤵
      PID:21176
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2956
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:22748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos59.bat
        5⤵
        
        PID:22756
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:19984
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:26432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos59.bat
        6⤵
        
        PID:26440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos60.bat
  2⤵
  PID:5132
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:11408
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos60.bat
    3⤵
    PID:15732
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:18444
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos60.bat
      4⤵
      PID:21232
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:15852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos61.bat
  2⤵
  PID:5140
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9388
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos61.bat
    3⤵
    PID:13044
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:14440
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos61.bat
      4⤵
      PID:20320
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:24432
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:14576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos61.bat
        5⤵
        
        PID:20752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos62.bat
  2⤵
  PID:5148
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:6032
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos62.bat
    3⤵
    PID:12068
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:13524
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:16856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos62.bat
      4⤵
      PID:17324
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5708
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:16196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos62.bat
        5⤵
        
        PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos63.bat
  2⤵
  PID:5156
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:13100
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos63.bat
    3⤵
    PID:17700
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:7860
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:13552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos63.bat
      4⤵
      PID:16732
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos64.bat
  2⤵
  PID:5164
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9592
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos64.bat
    3⤵
    PID:10520
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:16176
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos64.bat
      4⤵
      PID:17804
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:3676
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:15436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos64.bat
        5⤵
        
        PID:17504
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:26376
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:16688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos64.bat
        6⤵
        
        PID:6464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos65.bat
  2⤵
  PID:5172
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6740
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos65.bat
    3⤵
    PID:8608
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:8888
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:10484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos65.bat
      4⤵
      PID:10492
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:17296
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:20416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos65.bat
        5⤵
        
        PID:21036
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:22344
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:23440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos65.bat
        6⤵
        
        PID:23448
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:25260
        
        C:\Windows\system32\notepad.exe
        
        notepad
        7⤵
        
        PID:25832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos65.bat
        7⤵
        
        PID:2448
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        8⤵
        
        PID:21532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos66.bat
  2⤵
  PID:5180
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7756
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos66.bat
    3⤵
    PID:5784
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:15508
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos66.bat
      4⤵
      PID:19356
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:25716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos67.bat
  2⤵
  PID:5188
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:11140
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos67.bat
    3⤵
    PID:15380
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:19312
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos67.bat
      4⤵
      PID:22484
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:15188
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:17248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos67.bat
        5⤵
        
        PID:24212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos68.bat
  2⤵
  PID:5204
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7516
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos68.bat
    3⤵
    PID:9212
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:11632
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos68.bat
      4⤵
      PID:15496
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:16676
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos68.bat
        5⤵
        
        PID:20020
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:26924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos69.bat
  2⤵
  PID:5404
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:10784
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos69.bat
    3⤵
    PID:12740
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:16372
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:18592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos69.bat
      4⤵
      PID:18600
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:24288
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:24276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos69.bat
        5⤵
        
        PID:19284
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:26824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos70.bat
  2⤵
  PID:5604
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:12104
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos70.bat
    3⤵
    PID:11408
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:13864
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:25792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos70.bat
      4⤵
      PID:25968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos71.bat
  2⤵
  PID:5624
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8284
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos71.bat
    3⤵
    PID:8132
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10172
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos71.bat
      4⤵
      PID:15208
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:18392
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:21808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos71.bat
        5⤵
        
        PID:22476
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:14456
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:1080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos71.bat
        6⤵
        
        PID:22316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos72.bat
  2⤵
  PID:5764
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:11224
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos72.bat
    3⤵
    PID:15088
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:16468
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos72.bat
      4⤵
      PID:16768
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:20628
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:15604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos72.bat
        5⤵
        
        PID:6076
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:25936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos73.bat
  2⤵
  PID:5828
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:5320
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos73.bat
    3⤵
    PID:10696
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:16804
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:22920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos73.bat
      4⤵
      PID:9524
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:16372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos74.bat
  2⤵
  PID:5836
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:5636
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos74.bat
    3⤵
    PID:7756
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:11136
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos74.bat
      4⤵
      PID:17384
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:18576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos75.bat
  2⤵
  PID:5852
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7388
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos75.bat
    3⤵
    PID:8508
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:16956
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:19668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos75.bat
      4⤵
      PID:20236
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:7008
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:11384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos75.bat
        5⤵
        
        PID:24068
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:25212
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:26864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos75.bat
        6⤵
        
        PID:26936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos76.bat
  2⤵
  PID:6000
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9476
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos76.bat
    3⤵
    PID:9852
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:20248
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos76.bat
      4⤵
      PID:14148
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:23252
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:24332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos76.bat
        5⤵
        
        PID:24340
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:25800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos77.bat
  2⤵
  PID:5332
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:7592
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos77.bat
    3⤵
    PID:7148
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:9572
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos77.bat
      4⤵
      PID:11428
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:13684
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:22524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos77.bat
        5⤵
        
        PID:19496
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos78.bat
  2⤵
  PID:6148
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7360
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos78.bat
    3⤵
    PID:7524
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:18380
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos78.bat
      4⤵
      PID:21976
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:25920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos79.bat
  2⤵
  PID:6156
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7920
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos79.bat
    3⤵
    PID:9412
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:12884
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:15880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos79.bat
      4⤵
      PID:15888
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:20380
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:9896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos79.bat
        5⤵
        
        PID:21912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos80.bat
  2⤵
  PID:6288
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8692
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos80.bat
    3⤵
    PID:10712
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:17112
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos80.bat
      4⤵
      PID:15016
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:1692
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:22912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos80.bat
        5⤵
        
        PID:10744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos81.bat
  2⤵
  PID:6296
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:12580
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos81.bat
    3⤵
    PID:14372
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:18816
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos81.bat
      4⤵
      PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos82.bat
  2⤵
  PID:6304
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8220
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos82.bat
    3⤵
    PID:12188
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:12712
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos82.bat
      4⤵
      PID:21268
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:23336
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:13436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos82.bat
        5⤵
        
        PID:15076
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:25632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos83.bat
  2⤵
  PID:6312
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:8208
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos83.bat
    3⤵
    PID:11680
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:12600
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:22028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos83.bat
      4⤵
      PID:22412
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:25928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos84.bat
  2⤵
  PID:6320
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:13856
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:20004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos84.bat
    3⤵
    PID:21248
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:23812
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:8596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos84.bat
      4⤵
      PID:12376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos85.bat
  2⤵
  PID:6328
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8152
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos85.bat
    3⤵
    PID:9876
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10868
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:12456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos85.bat
      4⤵
      PID:12464
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:10788
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:25364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos85.bat
        5⤵
        
        PID:26228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos86.bat
  2⤵
  PID:6336
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:9684
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos86.bat
    3⤵
    PID:15804
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:22840
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:24216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos86.bat
      4⤵
      PID:24224
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos87.bat
  2⤵
  PID:6344
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8012
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos87.bat
    3⤵
    PID:10448
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:20152
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:6644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos87.bat
      4⤵
      PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos88.bat
  2⤵
  PID:6352
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:12648
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos88.bat
    3⤵
    PID:11728
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:18104
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos88.bat
      4⤵
      PID:21380
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:22244
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:22896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos88.bat
        5⤵
        
        PID:22904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos89.bat
  2⤵
  PID:6360
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:12708
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:18208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos89.bat
    3⤵
    PID:18076
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:22316
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:23660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos89.bat
      4⤵
      PID:23912
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:25408
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:18680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos89.bat
        5⤵
        
        PID:25212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos90.bat
  2⤵
  PID:6372
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:11772
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:16740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos90.bat
    3⤵
    PID:17172
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:21580
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:13932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos90.bat
      4⤵
      PID:20376
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:12596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos91.bat
  2⤵
  PID:6380
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:7952
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos91.bat
    3⤵
    PID:11180
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:20952
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:7016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos91.bat
      4⤵
      PID:7672
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:22968
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos91.bat
        5⤵
        
        PID:23724
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:27420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos92.bat
  2⤵
  PID:6388
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:8180
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos92.bat
    3⤵
    PID:11624
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:10184
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos92.bat
      4⤵
      PID:17392
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        Runs ping.exe
        
        PID:18404
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:2136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos92.bat
        5⤵
        
        PID:14600
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:27132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos93.bat
  2⤵
  PID:6396
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:14368
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:17488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos93.bat
    3⤵
    PID:17496
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:21236
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:16536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos93.bat
      4⤵
      PID:9868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos94.bat
  2⤵
  PID:6404
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:13692
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:18936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos94.bat
    3⤵
    PID:19756
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:21616
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:9404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos94.bat
      4⤵
      PID:10252
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:24404
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:25552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos94.bat
        5⤵
        
        PID:27176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos95.bat
  2⤵
  PID:6412
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9888
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos95.bat
    3⤵
    PID:14388
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:21572
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:11876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos95.bat
      4⤵
      PID:23776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos96.bat
  2⤵
  PID:6420
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:13308
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:18984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos96.bat
    3⤵
    PID:19864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos97.bat
  2⤵
  PID:6428
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7760
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos97.bat
    3⤵
    PID:11480
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:17908
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:21696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos97.bat
      4⤵
      PID:20440
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:11452
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:18324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos97.bat
        5⤵
        
        PID:13700
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        
        PID:19568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos98.bat
  2⤵
  PID:6436
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9492
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos98.bat
    3⤵
    PID:14960
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:16460
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:14184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos98.bat
      4⤵
      PID:18744
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:21244
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:26460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos98.bat
        5⤵
        
        PID:17460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos99.bat
  2⤵
  PID:6444
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:13772
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:19156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos99.bat
    3⤵
    PID:16344
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      PID:7136
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:17020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos99.bat
      4⤵
      PID:12024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K chaos100.bat
  2⤵
  PID:6452
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    PID:9084
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K chaos100.bat
    3⤵
    PID:11588
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 2
      4⤵
      Runs ping.exe
      PID:14628
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:13688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K chaos100.bat
      4⤵
      PID:8592
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        
        PID:16328
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:20292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos100.bat
        5⤵
        
        PID:6512
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        6⤵
        Runs ping.exe
        
        PID:5760
      - C:\Windows\system32\notepad.exe
        
        notepad
        6⤵
        
        PID:13996
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K chaos100.bat
        6⤵
        
        PID:17060
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        7⤵
        
        PID:13668
- C:\Windows\system32\PING.EXE
  ping localhost -n 3
  2⤵
  PID:6468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:10508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff95293c188,0x7ff95293c194,0x7ff95293c1a0
    3⤵
    PID:10720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,8791115579258222117,4282377309199598815,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
    3⤵
    - System Time Discovery
    PID:12396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,11621213813040565660,5729979024433191292,262144 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
    3⤵
    PID:12412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,1308832806640300876,11794136949263942726,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
    3⤵
    PID:12420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,14809211921993026671,11013763788968038635,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:13612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,900280995842098134,6158225000075533795,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:13620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,4383666644862214367,11302723068304285818,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:13852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,17596786976986416577,8333405848491050752,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
    3⤵
    PID:13860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4320,i,3269798447508173019,12068857656425066862,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:13868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,11383341194580793538,2002547030992206986,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
    3⤵
    PID:13888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4164,i,11596929250997480936,9568714939086609303,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    PID:13900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12196215264707410522,12302418141095252666,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:14280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,4021470469995331336,15578777792490983876,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:13376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,2019979185660164492,2436085603769986850,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:11584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6112,i,6952369966809894183,10382966313785195390,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:13592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5252,i,1505170944993138012,13393686210136635286,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:16536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4296,i,2388241751132066986,6952515432729282831,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
    3⤵
    PID:16520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6500,i,13467489932304222205,17292714049440245232,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
    3⤵
    PID:15964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,12766065417986281210,10893416648147727506,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,17718782787855080707,13147331481914686419,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:8476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4356,i,9939292598749376639,4961747512381310832,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,8610521775667814959,11380483618560392917,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:16604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,11684585183645214498,15756740044914077509,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:8788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,6374092073286813492,11340425296104100167,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:8272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1092
      4⤵
      PID:24320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6472,i,8267537122871760287,5643272107198601659,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:15564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3660,i,3416226835323567677,16573571950897396217,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:13720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5744,i,12891174749291114736,13573625342716532552,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:21236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5132,i,7504665225811859504,4450591205582431244,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
    3⤵
    PID:9156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4408,i,18279840387606088806,6660396885702294588,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:9048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,12766065417986281210,10893416648147727506,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:22888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6140,i,13724894987388660403,16859760157272711605,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:23216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5368,i,17663786266789575152,18218219582242545342,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:11168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,15297409415350718971,9661193152099563090,524288 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
    3⤵
    PID:9932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6388,i,12043290795949081898,4061801476914336137,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5096,i,17554022396885805667,17439001138428171684,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:24376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6372,i,16661545435613398617,8625359772512534043,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
    3⤵
    PID:23836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7000,i,738984507041828457,1878677668277559007,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
    3⤵
    PID:13680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5912,i,7002261815576275051,160372667650644756,2097152 --field-trial-handle=2388,i,17331337880257386271,6234986428398259198,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:27516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:12636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:15768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:17304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:16512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:17216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:18444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://.../
  2⤵
  PID:16668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:13628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5e0967e0d82502049a8ec5ca75b40fcbb39978a508d662f98559c6cf2ae2deaf
MD5 11679d3621b73e92ca6ff1f15818acbc
SHA1 831a4a687d2b6810c52a96ada8541d906a3f341b
SHA512 bdfd72ac6a9a1fcd9eb7dbea9186272dc16a7c12ba14a7a274b60c93e2ba84d75b29d3c07d61e5f9839b060d69a3a423dc8f6e01d3f38cbd94c3e00ee752cd1e
TLSH
T14C61FB7AFCB18014E7F405709AEA2054F27CFA48714BEE5ACEC981BD8AFEB114770510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d5c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d5c9.TMP
Size 3KB
SHA256 46e2f72533672d9c8c5e4905f5b8ee2bc575139c854093a8c3b5d56f3b3ae101
MD5 a2871d55a9722242c61897ff5bf195a7
SHA1 dd9ce77518ec05a91860f2845f28619efbc92e1e
SHA512 233ddb791161f60d95fd4c8d1a5dd9669e5b0802553450687d2a3d3f78eb1ca430eace52c0716979b75f6b2b60d268042e259f14fbb80e875185ca107f9d227e
TLSH
T18061E87AFCB19064E7F40470AAEA1051F27CFA48754BEE6ACEC981BD9AFEB114770510
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cebefa2185cc3a441ad532ec2f14972489dae6c584284c96da614d6c6c4158fc
MD5 6f625415d6fc2fd06d04db1870a8f06f
SHA1 d63b4696979a3fcb497e1c0ace4c9111d4c327d5
SHA512 982572e726203ab96630cff8ac5938e5f3ff53c75a2181029bca0de252dd8add62f9e1b1fc884e193a83b416f025df8c276db874b20551fcfbac5ee1527d052d
TLSH
T1F521ACF7C3E4857D8A0182F4AA197F2FCE6D0541431C3C5BC5F4AE1BA3E2861E14095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 aa6606c4bb66e6c02076914e9262eb9dd1525c6ba3461728d343cb3f9e621c9a
MD5 2a589e530cc00240fca35f1c18282e45
SHA1 500d64aecd0cbe4b7a5253c611d45c6fa101cbdd
SHA512 7b0dab6d1a7ffb25f68a6063047c211519d007d8b88f913ae71e0ffc11ffe701829fa3aefa2a64b6841a21867b0ff39def9e4ca419a50c2775ce9b75c1d63d8c
SSDEEP 192:zO/yM//K1Ml8/3/fTsm8fUcdpM/W6+WNGY0FuTfyIgyJ:zO9C3/fTsjfUsM/bG5cSO
TLSH
T10842EA11AB386937CCDBD209BA51BF53D6F95573A2900D4899FCCA0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 91212d892f1f77fecc4b65957fc62668cc94276075d840060b48078d90eb5483
MD5 a38307bc0a07da644818f4ef376b7e67
SHA1 6cb4faf0687928cec3e10cf6c9afaf42ce3dcfd6
SHA512 0f72d654bfaed2249e0643df26fe58b40a50f7e3d9f9c48917f530814e46e6a3ff40cc29186878ad1aba376dccbfddbc25fa4466fd0c06b6c6f743587ff2ec55
SSDEEP 192:zZe/yM//K1Ml8Mc3/fTsJq8fUIEdpM/W6+WNGY0F8TTyIg5KJ:zZe/03/fTsJfUfM/bG5MSo
TLSH
T19D42EA15AB386D37CCDBD209FA51BF53D6F9157292940D489AFCCA0C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8a0256022a6ca3c17903c0110ceaac9f9f494f257066ccae352c5f61d9f6099e
MD5 94dc44062ad4cab269469f7a38a1b1ab
SHA1 c24e482fdce72e8c43a02b27f5f4fd0f4d83a45c
SHA512 9c4771e890a0e26ff389eeb8489a8fa29960b55fae991a8701625283e437168651e7599bdd3ffb0aa68f46de9a28b32aa7233c3823caa88a1d5c43f63b43527e
SSDEEP 768:L1P7x8t12K0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NWzLl/cK0FT0roD:L1P7x8t12K0WRmoMQ3Au1jaKEzLpcTF3
TLSH
T1D0E22B3B284CCB7E4F844E9CDC26AF966DD801CBA6684D5447FA884C03C77EB951B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 858f5fb6ede0bc2916245b727e403faa9f5c55fd50ff49217bb2858f76d8e6cd
MD5 71917ffe5b6f772d329ce295009627a2
SHA1 308d5bad24d8c206a7eb20d63c4d3cbd51ca95f1
SHA512 dda96b78ecbdba3a979084546e49fd78290dfe66aa050ecfd5d6a119ad63ced2a240756360aa9033c924422ebaf1d25a7df1dbcca7091a88edae8244a03e7601
SSDEEP 96:K84YKhq+efSKE442VyKuURL+KgUK2RSKq8RGUKnKKg:y7V35b9Z13g
TLSH
T13EF11741B1BB13813ABE254A81D0B87E02C134737068A53B3BF956A60F67E54CEFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ace9ed88-2e03-4e75-9998-107a479c3030.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ace9ed88-2e03-4e75-9998-107a479c3030.tmp
Size 31KB
SHA256 e7104a0a81d0ef01d1b0f3392dfdc46e1779e05676a3d7dc61fb85d32b7cfb4e
MD5 b321002465974b90159cbb613bedbedb
SHA1 93cd231635a78a8688fda27944f3f670d7cd1653
SHA512 de18632e15379c6d5c36524d54f51da472df5f3dc1b27ce403d27143ec26981052c1d30d4a4910e7f2154f6f23c882381b0b6b092c2adf7a6fd0fec5efeee2a5
SSDEEP 768:LOP7x8t12K0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NWzLl/cK0FT0rol:LOP7x8t12K0WRmoMQ3Au1jaKEzLpcTFp
TLSH
T181E22B3B280CCB7E4F844E9CDC26AF966DD802CB96684D5447FA884C03C77EF951A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 2e576dde0a0fb8d3ab3eb180166b8db2c7f58d4a697b66d80ddd24a0f5748128
MD5 e191dccf097d54e13afd86508bd63845
SHA1 e27bfbf85a9d4c3e14ab11b79c0fbf573e950e0b
SHA512 094127a56208e93436a299a4081a5743224c975058929f2f072fb961732c486ec214e6689c66ead331ac1fa9dbfac497296e6d9cac4ff15062f8d2f993009c63
TLSH
T1A93123C1A3E661C4BFD9B982C10A741360E53D67261EA876632E94F45F848144B6FF26
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59624a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59624a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6b10cbfa7a2d63bebd8014da0f573078ddfd8e334fbe13ee669dd6b14da9a1b1
MD5 80cf596aa44f45dda6ad8c0fd5361e46
SHA1 a812095730dbf3913765179d7c4fde2aa38cf5f4
SHA512 3a4a1a1afd2e3b4c26d2d605bf25a9a51d56b74062f97020e0fc5319169782129abff24406464d6b9b21070e181b9346073ffb032bb49d867b72483bf920688a
SSDEEP 192:zTA8NudQf8GXnZQtQapQmiU1+inyY/Fl8sAM+oGbHnFuqJhfRif6uH:zc8NudGXZmQy5yY/FHAM+o6DfRiCa
TLSH
T158425A3468B99C339DE3A986F00B77638F7420BB99C55F89E5E85B1D01C729C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8fd4648d396b7741977dae4e79cf91d1ff41b14c4c48f432cda20d48eae4f30b
MD5 c04765833e9272c9b5f7524d9253a07b
SHA1 fe6cddffa119f93eac0d4ede5f5b523f2e09fcdf
SHA512 85ca66a98d1d8e0a1630c079e2a23073504214db96f10c39e12ea6d9d420e5a8474145a752d6fb2ecb3cb0c39ba188b3f2be9e07ccf50df8db54b594d1a2132e
SSDEEP 192:uu0K8NugQf8GXnZQtQasQmiU1MiI0Y/Fl8sAM+oGbVcFuqJhfRif6uH:nl8NugGXZmQ1jbY/FHAM+oBDfRiCa
TLSH
T12B424B3468799C3399E7A585F00B77639F7420BB99C44F99E6E85B1D01CB29C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 65d0bbc2d4ea7fe0050aad269668eb485d79399f94368689999146bf5aa5c0da
MD5 9195e290014e03c5c211a901687c2bdf
SHA1 22d014a493abe6a02631d3c6b81e9f05e2b2602d
SHA512 57b987daec2a6853bcc1799f0ac915847737755f0f71ce62f9da89f77419c79a8d834882ba4e187d36f9f841ae82bab484f17fb5ee8f7334acc384212be2e15b
SSDEEP 384:nniFy8N+8TUNTUlIlgGXZmQcwfqDf4P/FHAM+oODfRiCa:iFyzwgFRP/FgMyDfRid
TLSH
T15182C435D8A5CE3BADE39BC5F606B6979EF010A789C89ED4DAD85E0C00872DD170BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bfc566043356a24d9a85d22c07a45113602f81703942589f8293950b575a01c0
MD5 1e1c2227e249649b90cfb60fd2cc9c93
SHA1 7ebeeadbd97664aef66939eb0ae17ebcbb2e1073
SHA512 4c367fc718ec23e6d595a57b3cfe6d079409ac9422dd1701604f6c6350b64e262b0128dec2032d509e7b1a9435b9f477277079e414f02ac68b8bff72970e56a7
SSDEEP 192:vGNf6PtzQmiUy7n8ZB/Fl8sAM+oGb2n4uqJhfU6:vGNf6Fls8ZB/FHAM+ouDfU6
TLSH
T163122934687CEC375ED3A945F08777A39E7420B7DE849F95E6E41B1D04CB6882B0B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 61aa23edd1c61c6150e6dffb9a26ac135d212db8f47924848140a274cfc642c3
MD5 6fed03b969747fb14160a55340a1983f
SHA1 593eef73ff17b533c300219155b8c93533c3315f
SHA512 5fc91c2a3065c71f3185aa75db4f7a0d68a609f7bfec02c1889db21c363d34ab8cb7bbad51abe416bd2507ab6cea40dc18fb1894f42b29699f0d66d8ff50fde1
SSDEEP 192:zG8Nu9PtQaBQmiU10i88UY/Fl8sAM+oGbUnFuqJhfRif6uH:zG8Nu9FQcH8HY/FHAM+oLDfRiCa
TLSH
T160325A3468799C3399E7A946F04B37638F7420F799C58F99E5E86B1D01CB28C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 61e909be831ecfa8a1e2d09253738d676190a79f60dbdf6860c296ad830d847a
MD5 37502e2c0ba43ec5ad965fcd4202b0f1
SHA1 97886f01eea8127f07506520d46458052d6e278a
SHA512 f70c425789cf4dfd91159c3824f91d9efe1a71156d0f3aa3c3e968613b90b88c44a7d5a7624faf82f05a6bebaebb0de1aa55eefbd24bae600071a2e1517f7cf3
SSDEEP 192:zE8NudQf8GXnZQtQa6QmiU1PiS/Y/Fl8sAM+oGbGnFuqJhfRif6uH:zE8NudGXZmQb4CY/FHAM+opDfRiCa
TLSH
T190424B3468799C339DE7A586F04B77638F7820BB99C54F99E5E85B1D01C729C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5ab610d605b2d5f8af8a3d98ed0e37168687a46c3ea37de809c6c5c27f9ca865
MD5 27a8d586091aa2b42962c1d3d08afdb7
SHA1 cf0de81e088ce94626a304bcad741b288a4c48df
SHA512 fe78c0474c1bb533b9e69e9f889dba55f473d0be78399e1fecbeeba2455969583752ee6f97cc4f9fc3d04e6904a2a3bf6cb0a9d65faa084464e0ee014d535e20
SSDEEP 192:uu098NugQf8GXnZQtQa+QmiU1liVNY/Fl8sAM+oGbicFuqJhfRif6uH:n68NugGXZmQBKbY/FHAM+osDfRiCa
TLSH
T12D425B3468799C339DE7A545F00B77639F7420BB99C44F99E6E85B1E01CB29C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30f159a9a11c9f2d1e3cec9efb519f0c2cb72c0ae648c13bd0259a16c896d744
MD5 b1bbadeed141559de9691f8cb9164244
SHA1 cdd4954f2a4132f50c668670367694d64ee16f0c
SHA512 96d71460bf15ad2560e557f672f5d5041af9b8390370fe17f5d350ebc627bcc2bf2aa616f45aa70fe3f7327db75e7e9bbda0cbca6b289c6c2afe56658f33fb05
SSDEEP 192:ZGNjA6Pt3QmiUy4c8qB/Fl8sAM+p7rcNjU6:ZGN86FZHnqB/FHAM+BqjU6
TLSH
T1D702F93568786C778EE39E45F047B7235FA4206BDAA45F94DAE41B1D01C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 9f075463cce34ceb57416f1b655a869649ebf92d9388cdc0619a5a94bcc71431
MD5 e5b723b6106c99ea02863efbd7232168
SHA1 947fcec4bff7ef0c6f679db1ccd79e504ab4b934
SHA512 8cecff3ca0a00fe37e5b8bf6997683e84f445fc93fca73f9be77a041957db7e3173a5a319a97059c564b7e5054a18283477499589eca4bd5824f71129ef3128b
SSDEEP 384:nniFr8N+8TUNTUlIlgGXZmQTRfqDf4P/FHAM+oWDfRiCa:iFrzwghRP/FgMiDfRid
TLSH
T1C182C535D8A5CE3BADE39BC5F606B6979EF010A789C89ED4DAD85E0C01872DD170BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e9093f8e51220a3f0dcc724f08eef99d4ea6e054fccb46baced1cd4c2abe0cfa
MD5 a9f1b9f6c4128be482ca037e3f43ed2e
SHA1 9b9e82ef29a2ed806fcb388b51d2961b3dca6480
SHA512 7db13a21a0b03304aaf2855c242f59ba34f47e5cb7fb6f1b6479f9945301672a29ff71b9d4188b96efb873e850490201dd737ec053f832d7a8ac45926c73198d
SSDEEP 192:z0A8NugQf8GXnZQtQapQmiU1+inyY/Fl8sAM+oGbHnFuqJhfRif6uH:z38NugGXZmQy5yY/FHAM+o6DfRiCa
TLSH
T14B424A3468799C3399E7A986F00B77639F7420BB99C94F99E5E85B1D01C729C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 5499eccb2ab66ed9dd75d7c9935111cc55cf611e075e767545bfd8dd65e5e7b9
MD5 9fe632fef21a4d17adfe38a200d56ada
SHA1 842f5d03889589846be0af9a269f7d500b0878eb
SHA512 6d0c4b5cac19082b275fb9693c0c225cebe36135843d69c636dc06a33c26d4436a113a2e5ebb151d1c23fd830d51f7dac0e6aab0d4b0ad8f312e302ddeae833f
SSDEEP 192:zpGNu1PtQaBQmiU1giEZY/Fl8sAM+oGb2nFuqJhfU8:zpGNu1FQcLGY/FHAM+o/DfU8
TLSH
T1D42229346878AC375DD7A985F08B37A39E7420B7DDC49F95E6E81B1C05CB288270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47478fda-09c9-4688-ac14-317f081d6f60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47478fda-09c9-4688-ac14-317f081d6f60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

chaos1.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos1.bat
Size 172B
SHA256 293066f4d649f706faf5846d37c0f3b84f7a724b47cdb9fdeb1bba5061ff71cd
MD5 64a5afd732940961d09dffbc0ee87d6e
SHA1 1d4308628bd3b53c00ccbaa5930e3be81a1189e7
SHA512 49f201be6253beceda337bccde4ee70812273c6430ae1972c2a3d1ce0bd919c05fceb5adf3c413fa8147a8aafe5261152aaa8caf26fb63907edd2c7735e4e781
TLSH
T197C08C312D09F943291509401EA49A28300D12AF42C26E81388628B1989B8E9E6F9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos10.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos10.bat
Size 175B
SHA256 ee42e3597dfb808af5cbd3d9a164ade2c602cc8d5625687ead7d6ef680a7b4ac
MD5 8fbdaabc05f51bf6858f3e04544ee729
SHA1 46f4e5fec2652a3b471b8446be04aec1711264cc
SHA512 46415a4769e8cb0cbba263f312eae287fb3dadbab7835c1d0cd2738a2f40df2c6229a56493b1d130d5760da2b2dfb33f345771b0c5e669338c37dcddea51f953
TLSH
T12FC08C322D01F94328250A481DB5DA28300E02AF42832DC1288A2871588B8DAFAFCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos11.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos11.bat
Size 175B
SHA256 8c250b167c0c937c64a86a0aa0643f72794a622ff067808abd2e0e624ddcae48
MD5 d113594d15d540c9d095c2259a6f98b0
SHA1 9d5969bb07047e34607bd41b14b643318108d766
SHA512 0a7c51306c41f06a7b14f3218cc7c32a0f8efcf722b5799c3dc30f413d3d053393bbce7541be36e15ebff4412cc138ecdb4899763c3fd4a7e837994bfdf23374
TLSH
T161C08C722D01F943286509401EA49A28300D02AF82832E8128CA2871988BCE9E6F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos12.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos12.bat
Size 175B
SHA256 3884a919bfe7cebba5fbc9786e2c99034a63f6af549cc418475611dab512b2ff
MD5 116f35bb8a8e08c9d10c9e09dcd7080d
SHA1 8bde7944c0339caf35be6c31a669e79da090c89a
SHA512 70861ed2ac06094dd6e37048b9055663343b3737271a2db9067ceec11a7a9d53f1a31535af2bc17e0a45e00bae49351f1a03cba0bd52cf7c48a83cb71d0abf28
TLSH
T1F6C08C332D01F997286509401EA49A68300E02AF42932D812C862871588B8DAE7FDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos13.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos13.bat
Size 175B
SHA256 bc7c1ac52eedf70ba8edc5e49c7bf4ae023007dc4e92596eae19728d7825450c
MD5 f86399701270d77661c29d56b7a43420
SHA1 e956e8b0e1543c4c65e797e3e96057e5f0dd3394
SHA512 130d8e96823e760d5ac1deb956e3f25dbb4cb1a0af4ac285aab6fc513662c999bf42f9632e5485d8227b4983c998d0cebb6c7b4213e2520c2fd7bda065800a7f
TLSH
T13CC08C326D01F943283509841DA59A28300D52AF92836D9168872875598B8D9E6F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos14.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos14.bat
Size 175B
SHA256 5c0d6530a52f46ee0b3aa41e78bcebc81be9a0820bbb2e727060fdcd840908b4
MD5 8f0544e03a28966543e279a906ad3866
SHA1 cd16e71f965a3c243e1c3849480bf75eb87b338d
SHA512 69e47ca0b1d171f0f467e9d40e2b170fd59ea40b4d81e6bdd0e16c2f970f18124009aff974d0109898d54243126e53bd8361aaf751c6b47d8b8d9d068cf15599
TLSH
T12FC080311D41F543681509401D649514310D115F41832DD11486587258878DEE7F8D11
MD5 SHA1 SHA512 TLSH

Submit Download

chaos15.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos15.bat
Size 175B
SHA256 3dc0bfbcc4793b7ee3db7eb4c5336b6c5a74cde2cb134d32ea10b5a0e9a88514
MD5 a4734911421427506b0a70417b3440d8
SHA1 bc37f41b7684a146d74f3b826f2429cf3543c8e5
SHA512 e1f5ce05543440a6e6d36cd9cb70ec7a99f039bb70c82aac32e6c85a648bd14120730b49a99da94e652323926f6d36c5f8bd732a417aebbf0a71862d8421c879
TLSH
T14BC080352D01F943281509501D64E554310D015F41832DC11486187158878D5E6FC960
MD5 SHA1 SHA512 TLSH

Submit Download

chaos16.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos16.bat
Size 175B
SHA256 0a01a253bfa22e359e0105193ba267a10ea1851731f3ae9c9dfe4d875e801eb6
MD5 d93412728f315c4daafba6a17180bcbe
SHA1 d5f31a509676cf281bf805416e28e9520a97bc5d
SHA512 209060e2845c095c6e4e9acb1ab30657757f88b41c3897cd795bf9ef63ad22a73dfe1feb9aa7cf359354a730fe04701589e4cc9d0202b73be1a6148a24d2ff55
TLSH
T136C08C362D05F943282509401DB4AA28300D82AF4293AD8628876871588B8DDE6F8B20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos17.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos17.bat
Size 175B
SHA256 48b6458abbee6b985c7c0cde331b56539b0337039a2af04b605514c7edf22126
MD5 14b1c32903b4c1ba0e145593b27734c3
SHA1 709a9bd830a020320b9513b5d6260011e05eb51e
SHA512 3dccba8b5c320c81d8c39587a84d80f3eff6d6145c76ce23b3fa8ef7f000508fe5811082e2ff73bc3f96c67fd8be798aadb7d79537b13d50e4c863ab1464aa72
TLSH
T129C08C322D11F94338260A601DE49A28360D02AF42836D8128C62871588B8D9E6F8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos18.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos18.bat
Size 175B
SHA256 63af006c3c076c96d18724f811028effd2fb9bb75df31f65979d5de87d2e3c11
MD5 bec70d8fa4a1aa7cc0dd7ace03746b1b
SHA1 07f12d9da670c4bbf4f631c842896e0fcaa130ed
SHA512 625d68bcbb67993e7fce4e10f8ce3061837cce428567afef9331336bcdcf7b4815bd75bc4f0a14817580fd49dfacffc7d37805e83892886909d07f51a24a6723
TLSH
T107C080311E01F54328150D542F759514300D015F43832D811487687158878D5EEF8910
MD5 SHA1 SHA512 TLSH

Submit Download

chaos19.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos19.bat
Size 175B
SHA256 75122e55c56bca2659efe2a1ec9f20fa520214bbdb6c7e6fef39cfbabed93b8c
MD5 b78cf160f0486ab3588f53fe4b243ebd
SHA1 a557c74e9f7d9075014147f50886216f6396e2f0
SHA512 96ce9c2f1314432bddc06b3969786a76060b671e3328633ec7bddb33a5f551c00142071f9115a908799a35d2dbb2dd97fefdd273d3a36c14c3bcf1f68decf66f
TLSH
T154C08C322D01F94338251D401DB4DA28300D02AF42CBAD8229862875588B8D9E6F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos2.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos2.bat
Size 172B
SHA256 4d1de34f5ff17494d91e0c2070e6c8a3dfae27ea16c2c1908d68b192ea56c1ac
MD5 61e2dd5d723f8bbef2e0d04ade62d3be
SHA1 7425ed302bcefd871b59e35bf8a768e02cc605e4
SHA512 e6083846cb3fdcacc005e163af9c518ba1606ece1426782e2cabdaf9be83869b0cdfb4b1c9c0377ea773108f35a48db54fb768d937a88a840805b7c3a08024cb
TLSH
T1CFC08C322D01F953291509401DE4AB78300D01AF42DB2D8128C624B2589B8DAF7BEA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos20.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos20.bat
Size 175B
SHA256 4d147343a4d200318431df4841b56dc4609eaa177feeb58389fe875db0a95815
MD5 827ca5aee8e2862d34fc6cbacd3c9116
SHA1 e78e2d3c439b3e68902dea3b1b801f81fefad6fd
SHA512 9f74b7c7257726d1899b0d60272ab34505918b1fe43a8a665cae4f4c89824e8e4d6fefc70b2f89c21dbfb583e0f19347bf5a7bdb8fe6973522a0dec7c7971844
TLSH
T178C08C312E01F9533825098C1DB5EA28B00F01AF82C36D81188A2872588F8DAFBBCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos21.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos21.bat
Size 175B
SHA256 6c00f9dd534b52e1c3ad9be37d551a59b8b422aef666d6f6cdbc76a6134e7e9c
MD5 05e30500511ae4116adbfb3f07d8a197
SHA1 b532410d540d74df9cb86d5fe9bce17061fb2b3b
SHA512 464d8262fddab8c787ce16cdf54da24e7087ebd0aaa46d67c5d4fceefef43f066046be2a6f778dca363a3b313339b6056855ad2be1420106a26517f5ac672cfd
TLSH
T1DDC08C312D01F963382509401EA4AA28700D01AF82C36E81188A2871988FCEAE7B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos22.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos22.bat
Size 175B
SHA256 2a7b30a47838041c8b61965c4d033a6a241d21c905c72dfda3ae9bf488b8b52e
MD5 dd93edfc1926ecaf9b775f947d89eb74
SHA1 acbdccaa34f7778e47c7b1ec4c8b82d6cdb82c6f
SHA512 d4d2fda8022ff67b03e4d6f8dc354e31d4eabf17be525caf55e463d6d78764c234024693f46277ee9db57f824f8680a93027cd0486b8a3dd546fa235c97dc08b
TLSH
T10DC08C322D02F993386509401DA4AA68700E01AF82D32D811C862872588F8DAE7BDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos23.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos23.bat
Size 175B
SHA256 8c2dbbcb36852abf050f40ec81658c539bc538f93b6907afe1aec05c75411205
MD5 500750c8d3077d9c3d57921eb653ef8d
SHA1 409a64fa4faef5789ac6843457ada78b3070d3f7
SHA512 0bae5a7ff0f11e40d8ad438967cd1bdd2fdba23cb6071043229f9b6c7007afd000eea39c0b8cedefd0d5094c5223077889a9d8f6489082f88bb492e9edc08275
TLSH
T148C08C316D01F953383509841DA6AA28700D41AF82C36D9A18876875588F8DAE7F8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos24.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos24.bat
Size 175B
SHA256 a5361131f525f51dd27fe843e125d35104053fdde5cf4a6fe1a42eca4af9000c
MD5 d77810aa5130e3a75637f46d6cce87b3
SHA1 9217fc8739c19cc44712aaa51a47513c1806d2e8
SHA512 ac9f005705b0d39a58b6c1739a1ddff7f2dcd1f902e7b2c1f7a8778d6cbe21149ad39f8ab062e50b4e61fb21456f1db2ddca2da686fbd9e377f8cae8adcc3b4c
TLSH
T124C08C312D01FA5338290A401EA4AA38710D11AF82C32DD118862872698F8DAEBB8E21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos25.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos25.bat
Size 175B
SHA256 d4ac977470bab697360810b4696f9f13928d3b372466d43619968116d65b499a
MD5 6a35447fd1e6dc6f66c3c6835cb9ceed
SHA1 44a1a9080dd50ca893aa22fe12dcf92a3069bbd7
SHA512 ef13d58cd0b99b7c134e3f9aa0e81742e007ee980bb81d63aa9a040c4ae74e9cc9187df014e0438ef66db8d127536dd9e8e28bcad7661e8df9af01919d47f70f
TLSH
T128C08C313D01F953382609401EE4EA68720E01AF82C32DC1188628B1988F8EBE7BCA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos26.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos26.bat
Size 175B
SHA256 b5cceedd619e35c9e2308682e9b25887b715eae22c76b84a2ec9eb40171fa943
MD5 fa970462f7f2edf1deaa26ddf7579f2c
SHA1 eae251ae77875ed9d7bc4f71e83399d77fdca4eb
SHA512 9097f9ab7cddbb557638620e2782a3d00145864a1e4c587906ffeb29517b7e8cb8b5747d90c6cd93b308569860b51e4ea13e76ee9927e39d5a8dd375cd1f5b29
TLSH
T1F4C08C352D05F953382509401DB4AB28710D81AF82C3AE821A876871598F8DEE7B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos27.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos27.bat
Size 175B
SHA256 db2b044395bdb9111fbc42c490b14c80bc7b423452766c5e70d52c42b9ac4ab7
MD5 0e34687289b307df141661467d5fb656
SHA1 e7950fdbe0aad552705d1579e9bf11960303a688
SHA512 edf7d9cb759e66bc989a397f1fb9a5bb8d38f43b9c56c7921c23556a6c460a4a37d0b751677f52508254588297d4afe45ed3d0d59e3559e738bd7e1c5e5c04a1
TLSH
T1BEC08C313D01F953782509401DE4AA28760D05AF82C36D8128C628B1588F8DAE7B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos28.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos28.bat
Size 175B
SHA256 f5c199241617b2f4a3f429c3d8d237fcc9d7f9fbcd32ad03d32d57f823e2ca44
MD5 29634e14f199ade76f83e1428b8b481b
SHA1 8ef0d1c3108d3980bcd002283426883cc597b7cd
SHA512 11fd970301d9eecac9bb07714201f2c6a87d095845ba0ac11a429891fa807465584b7cfbdfbfa7decbada9b3fe447241b64ab92bb5cbd7cdbbcacdc0724e80ca
TLSH
T145C08C312F11F953382509442FB4AA28700D01AF83C32D81188B2871588F8DAEFB8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos29.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos29.bat
Size 175B
SHA256 3ba275592885691e3708f57181eb6ce45ee845f9845b4138d88470fd869ddfff
MD5 48539f83a12cb3ade98ff5937ae791d9
SHA1 35a92ac232e73f20311742494c7a0f59e2444662
SHA512 804435a12485dd471fa9de8a8fe4e4e7a50b1746d2d5f9dd9b5928e07433a7d31e832627ab5fb549dd25f6ac4dc4222b91b6d8486e949a78b2840153cba1915e
TLSH
T19CC08C313D01F95338651D401EB4EA28710D01AF82CB2D9218862875588FCDAE7B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos3.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos3.bat
Size 172B
SHA256 06073aa4473ce02ed95869bff34bfa63629b33e08c312e884f6bd583e83c32f5
MD5 a790ad32ed0e518a1100427a4bece251
SHA1 7933a77a2c8c29745c4f29d52eb2cc517b0ece88
SHA512 55c2aca2230a91ae027707b7c76a2e30e786465b559711c9abec44b0034337c0017e8d30f52152f21461b1d28b8fda2829449715d22f760dbc58e24cc60d6c00
TLSH
T1D8C08C312D01F953391509805DA59A28350D41AF52832D81288624B1589B8D9E6BDA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos30.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos30.bat
Size 175B
SHA256 fdfb53bc821d0f1a9e2aa6bf477525984191a9eaccba5a82f5983430fd2b28d8
MD5 85d3baf5d9e99947ae482a2323a6e95b
SHA1 9255a853c6dfd00278a0234e9d77409cd67e4681
SHA512 c14497bdfbc72843a4f4621d4517f82c537dc8276d7206fc9502fa158487c06a0bf6145e04f3010598be0ee899dc51192bb0d9fa9c34e0c394b91b440dd9a133
TLSH
T117C08C392D01F953382509881DB5D628354E01AF528B2D81188A2471588B8D9FABCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos31.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos31.bat
Size 175B
SHA256 6374c55978e413149d260d0ba7b015f23df06d299d3e294347c70be94be54636
MD5 a8022c4f39a3268411c56b3a5719d592
SHA1 bf622b63248f62cd87bb2b07951c9c9041b9c3f6
SHA512 386e766caa9e92114a260d9aaed40644b94719507896bc819ecae721a2b1d80da3a21491d2d8723d0a5d164d7e0c8539d5d7111dbcca7dd5d39771151123127f
TLSH
T126C08C312D01F9533C2509811EA49628350D01AF928B2E81188A247198CBCE9E6BCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos32.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos32.bat
Size 175B
SHA256 e1667244caae7c969da467b6c89886e2f3cfb03cee47a33a1c56f1394c7997fa
MD5 8efdf1717d52a8703d447c5eb4e35f11
SHA1 d4c753b69fad077ff598d7ad838b45d34ba93071
SHA512 86d7d436553be917bc68575f5089735121a02f61630bce6bf5d2712244ff15c49d7f3e6ee6808d5aa8961a0220799b2293679dca6ecf50c3db09b7b08b49c835
TLSH
T15EC08C322D01F99338650A801DA49668750E01EF52DB2D811C862471588B8D9E7BDA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos33.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos33.bat
Size 175B
SHA256 1d0efb119ba5b585d3bdfeffbc58eb0eda57141ebdbb1f3ec291f9c963d24d76
MD5 9533a577f82a0cb0df5a9b7df5cb9871
SHA1 64eb42fd58ad6c92e766ef697bba01513f6ceaf0
SHA512 cb3e6789e8d680530ec6efd6c8f970c06f1ab26c03374bf107f07d66a9fbde0f0eb83ef492fe412d793946d0c7efcd20966e8cbc9692eb48328d9f04a97ac9bc
TLSH
T150C08C316D01F9533C3509841DA59628350D42AF928B6D911887247558CB8E9E6FCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos34.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos34.bat
Size 175B
SHA256 83ddc1ae0cac7b95192bfb9c03d42d35adc566808924231544a8a6b63bc6c37f
MD5 2fdb07330b1882eb77b8fcfa7f674ddc
SHA1 820cdec5d869f7091efc66a8a346e08429c34051
SHA512 38e058f7529bafcc5163b3566e8f427e51587171ab28612a447ed46c98cdd48adfb3320052c7955a3df7482024fd7fd68d59ee6a51d36378cd90d8d3dfca88fb
TLSH
T160C08C392D01FA53382909801EA4D628360D21AF528B6DD518862472688B8DAEABCE21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos35.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos35.bat
Size 175B
SHA256 b5adba40d2f00a73fca44c505d51e53d1906ebaf9375744496fbe14427f7cdf3
MD5 936bbb061eb86d409268a7ba9b3da92f
SHA1 02fe2ded4d09c3cfff3248aa7ba3349c6cf9c37f
SHA512 c10e08a291c14801289a96d17f029c57d3776ee9fe90973467c2bb2f8eb76a7f4b81b379b62e6fb963497e9e668e767afa210fc9ec4fc119f6291fc5e79a004f
TLSH
T10CC08C312D01F953382529801DA4E668360E01AF528B3DC1188624B5988B8E9E6BCAA4
MD5 SHA1 SHA512 TLSH

Submit Download

chaos36.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos36.bat
Size 175B
SHA256 27d1774dbde4b20434c44c68e896ac2f34a908520af75aeeb14a6ba133634b09
MD5 a7f9e099b58af72b2a7ed6ef5fe24cb9
SHA1 17fee2b0a3b124fb11d6f13a74f535c39e980684
SHA512 661711b2fc39f994682426b081e0133ff017423de6f1a3270a398cd262f50ba4f61b65612bf8bd68483a506fc7e22ae52c4c06eb6f70d2070a3da53e5a2bd394
TLSH
T12DC08C392D05F953382509801DB4E628750E81AF528BAD8218976471588B8D9E7BCA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos37.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos37.bat
Size 175B
SHA256 22cea53220701c075d118c28169e9d8c5fa76cddd22df5230663e330bfef2f9f
MD5 eb544296eeddb9dfdd600dc06eadce1b
SHA1 8e9e7224ec97813aaec832ec2ff6cc1da8b4d7b6
SHA512 edf7f1fff4e3f519f21a133cdad35346a83b8234f21020bb8b8e0bea8f38c752b1dbd2edece07d84205fe24ab81cf0c28fb18e68de3b65b742ee0c5ea1766583
TLSH
T182C08C312D01F953382529801DE4A6283A0D01AF628B6D8128D62471588B8D9E6BCA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos38.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos38.bat
Size 175B
SHA256 053863dfbd88fe45f1ca17cac6cdced76720e2a8c8ba62387e6fa72df2df03d5
MD5 87dab786c8648bf911530f3fa267d3ce
SHA1 c383c4135d8add1ea1bf0db5a35a97d660e4c3a0
SHA512 9a8ac8b0be286bf67a42c0ba56082e5191b59bde5b7241d6252894cff6440982e40ecc5943dd30db46bcb0ae5dc1701c2016bbcd38331920e17c3eb47e525ec1
TLSH
T1B1C08C312E01F953382509842FB4A628350D01AF938B2D81188B6471688B8D9EFBCA25
MD5 SHA1 SHA512 TLSH

Submit Download

chaos39.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos39.bat
Size 175B
SHA256 3aed23d6f8075ebdd2d34efe41d85edfbacad30485239449749a156017291ede
MD5 a46c7df08ec8b45695952a913f1fe9bf
SHA1 cb3d02990aad280deab2ebd49c8c5363f5eeb27e
SHA512 28994b0356e9c73bf22183ad2cd638e4559588475b3c626eb8b2018ec57f5a97b3dbc039bfeec7e9a32748c02a6749bbc46d248ea963250ecaa786a06c3691ab
TLSH
T181C08C312D01F95338252D801DF4E628350D11AF52CF2D8218862475588B8D9E6BCAA0
MD5 SHA1 SHA512 TLSH

Submit Download

chaos4.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos4.bat
Size 172B
SHA256 a10afce56cf74171b41cc4b65aab9e8f2eeeca8b1e90424c6892ac40645a8a38
MD5 f7d0af8d67b25e59295137d4d0a8f10a
SHA1 a0ce726567624bab827e56a2215849cb53f32908
SHA512 51b7c9cdbb63773a7645538f75d08bded5bb80b1de161ed5c526aaa7d3f5ae485f908c14b4de6cd80ed600f084d0f4d1bfe18308cdeb6e2dfb2ad74b60f273e4
TLSH
T18BC08C322D01F953291509401EB49B68314D41AF43822D81288624B2699B8D9EAB9E34
MD5 SHA1 SHA512 TLSH

Submit Download

chaos46.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos46.bat
Size 175B
SHA256 9e85b25ec9765a572b73c8eb4680c75234695e59004745ee53ffd9537726edbe
MD5 a415d82b5d8f6c549968304458b939a8
SHA1 0d93152a81de0de05a863f0b791a9ccaad8c16cb
SHA512 05220380b5d1f31849420edd7672750633eef735decad0af5474b0d6baaebc55875c1b43ea9b21c8947ed8b2b72ca43e613efa41de609ca345b5f12b0b1c2882
TLSH
T100C08C362D06F953282509401DB4AAA8300D91AF6283AD82588764715A8B8E9E6B8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos47.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos47.bat
Size 175B
SHA256 dda94c77083f35fe5f7ec9890fc14363f7b09156065825e54ad4cb7672078327
MD5 f66f0905fe878d9266c9f7463c68a407
SHA1 a27e29bd38ef5843d54b54619e076fe5701fe92b
SHA512 2110a4a5aeaf7066d6873e99fdc04bfdb25887da6d2bf45df2658709ebe019ed2197123d8e6c7eca05fe08a5ef116b6b3a44a91e03416be328d44b81425c88e6
TLSH
T174C08C362D02F953382509401DE49A6C360D55EF42936D8168C62471598B8D9EAB8E60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos48.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos48.bat
Size 175B
SHA256 48eba7824bc4bde3a39dda245d5296141974a1ce98df3783fc88ff66d78fe002
MD5 2cf0cdefac7c01428ad39f2c84083636
SHA1 e5cf91eaf4cd84bad4311bb7438981fd2c6a81fb
SHA512 a905b2d2f3629892f35523e244b57899eccb501937b668c6a94bcca380403081517e20d966924a4c03dced26728156bdf9ea26656e64865c83c46c2315aee946
TLSH
T182C08C323E02F953282509442FB4AA68300D41AF83832D81988F2471598B8D9EEB8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos5.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos5.bat
Size 137B
SHA256 3008aad29060181b23d3aceb92bba5308f4ab8a9dbfcae631f4a19bec76f5a09
MD5 e06be3e13fbfd1ec5a0e87e8ac58db70
SHA1 841426d76d1c4767459cb51fa105ed62d063333a
SHA512 144050c0d2719b012801ee586c437f716589090ac6690e3bcecd574e40561fa89c46947c3345c13f4be4010a100eb0f7440a16749749d0a1559bf475d0c89e22
TLSH
T1E6C022223E08FB83282200002CB8C838320E028B82833EE02083003288E20E8E2EEA00
MD5 SHA1 SHA512 TLSH

Submit Download

chaos5.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos5.bat
Size 172B
SHA256 fdd488ffb76bb563b1feb2ead7c6c055ffe385a2349121eebb2dff6a840255d4
MD5 e75b9708f57c6634150679d3cd911764
SHA1 bd0fcaa237191188f36fd70a91c8685d84d418c2
SHA512 8fb9c4cf92f004e6f22184c2e2d73a1bfa20725272ffe04dc44c8aea845c958290c3c5e52a5a8520e30902a2e2f5a31649b41840ef85fe73c3418000585e8d7b
TLSH
T119C08C312D09FA43291509441EB4DA28320E01AF42822DD1289624B1589B8D9E7BEA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos52.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos52.bat
Size 175B
SHA256 d3efd62cf1c5cc1e0b0f1a5041f5b00d114e40b19c7598972a19dce66757d742
MD5 24dcdfdb91fd07ff60f7800ee0c149ab
SHA1 93ea266d1ce99133fb7ffc49916a3dc44c8bef5e
SHA512 8b8ff1d5fb420ad69ba5ae66eac1537254b6ec1f6b4c78fe6a357dc686a9be2e0d3f79251ed6a77fbdd452fb37b53ff77060e357062486d20d7a1dd841f14458
TLSH
T159C08C362D09FA833C6509441EA4D668300E01AF43932D811C862471588B8D9E7BEA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos54.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos54.bat
Size 175B
SHA256 8e2d0e9d9e74d28f15af2c73ebaa49da5e47c3c341d3d283f1990e848472843a
MD5 e3fc6da63aa3f06ae14109053c0a1655
SHA1 24e33375ff863b47491a90223faec243cc7e8dc4
SHA512 1860e4beeba19bc694771a5d75708a293e56172dc6c7ca64892c69676ac89fd605bb2f8a2eb95fa11028ce829643475acd00ab1c6c117219312327e8ec9dce75
TLSH
T11AC08C352D09FA433C290A441EA4DA28310D11AF43832DD118862472688B8DAEBB9E21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos56.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos56.bat
Size 175B
SHA256 ac2263bfec87d57d8f9384a2b8e8e35c3304ffdbe8784142b4e379a056b70fe5
MD5 4aa2b7d0ebe8085baa4b340525334b22
SHA1 85bec73d57f20c21ab8073ab16f460bc1fbcceec
SHA512 8bccc8bbc95ecbe926c7a00fd078474e7fae21ae108da4c4816bbd45a292f04ed1d8c0145be59a5700fbec91f8e61348ab90a01bc7c34e13f5322084b9247a0c
TLSH
T119C08C392D0DFA433C2509841EB4E628300D82AF4383AD8218876471688BCD9EBB9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos57.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos57.bat
Size 175B
SHA256 66dbbcf3ed3cfcdccfd5de9faf9afe9a5b95035449ad07c15fc6ec1e8cb49af3
MD5 b2aaace95221a826a9e06eb74e9aa57d
SHA1 97e6a9d4e0db3e7e0e479ca99996eb8314b5cf7b
SHA512 8f33c7a37e9ad7cb4e61834b05eea308c1bd47f10e378014808e3b85cc9dca05d76a13e06f69c5c3e54e0ca5d8fbb47b9071af991bb8c1482fc1116830dd74f4
TLSH
T1BBC08C362D09FA433C290D441EE4D628360D01AF43836D8128C62471598B8D9E7B9EA0
MD5 SHA1 SHA512 TLSH

Submit Download

chaos58.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos58.bat
Size 175B
SHA256 a308e33461a3b7f1f5f3cf4933301e851113c1760f2b29ba08e6083fd36aaa14
MD5 dce50a9ef806aa70f056bc832c137bd1
SHA1 c8ee1ce9f8c5261bee1d918a7ba3ebb92f9075a8
SHA512 d64b16a3f6af8ecf89f1a47aa46be2dbee200ca4a3184c61f7fedfacf4dd55e0a3b4c51879dbbcfced372554ea85b1495bdd91e3b76df2e5b64ab1a0475cba8b
TLSH
T11BC08C352E0DFA433C2509482FB4E628300E01AF83832D81188B2471588B8D9EFB9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos59.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos59.bat
Size 175B
SHA256 e0ac691ce96913f62dd4e0697f051bfe2f0387eff334844d1e3ef1ffc4ceea36
MD5 c20a4be9a607faae6c8a50c879bfc094
SHA1 486d8a15169dd99a1c0ebd75f6494f2346bdb2b0
SHA512 181181c30c109a55288b9a9a6e8110ad1a49a35215de53f9a4b967a892a4cc21cfece4b837ab4f5f81b7355b541f721195a20d7a5d4e3e17f69fd4beae073b20
TLSH
T1F4C08C356D09FA433C251D441EB4D628300D02AF43CB2D821886247558CB8D9E7B9A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos6.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos6.bat
Size 172B
SHA256 d844ea91f25fb8628b5934ae3abbbc8e20f082a9b4d5fa08d6b4e9cb6f8a1b1c
MD5 676f7bce2f17661718cc8f06e7a5ffde
SHA1 1bec6b7f0c476e194c27a73733d2af0c4fa674a2
SHA512 2e7d534cbc30069d1884c69ae82df683214a98046d160f062513d430135c7a94421be870e0ebb3ddf96dcb991b094a3a086e97b2c1e06ccbd9eb5aa8cab5663a
TLSH
T14CC08C352E11F943291509441DA49A28300D01AF4282AD82288764B2589B8DAE6B9E60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos60.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos60.bat
Size 175B
SHA256 0d93dac8f5608a90011fb32569eba3912c1cf49d27a921f1dd8db81d80244973
MD5 b181f0353240d57eb3a4888b6eb0b55f
SHA1 99e781dd212666d0674f329f7d2041ccaa22f8d4
SHA512 f574a000bfa6933664d1ba60665b6e62132eb2ae10edf46c5b329b1dc5b6d418ab5b30c1ed58809a64dccd138757fa8b7b4f8bcd1156cfaa7abf3d3383db0123
TLSH
T1F3C08C312D01F9532826294D1DB5D728300E02AF42832D85188E2472588B8DAFABCE20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos61.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos61.bat
Size 175B
SHA256 504acd8192d4e81e48d2fddad41c5a66c6807f92fb782b2d7ee22f429dee5213
MD5 d4ca47034f8657bb3ff1176a88a1c99e
SHA1 601be93ae8d4a0b6163a676a88c82d661c92dff9
SHA512 d1257a3407ae1f4d3547a61e3abbd1c8f6e1f4dee4c4e954822b67b10be7a5da802d727794bdcdb62752a3eb2cac6521d4c712f99ac83be09125d2b8e7a42b86
TLSH
T1BDC08C316D01FA53282629401EA49628304D01AF8283AE91188A247A988BCEAE6B8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos64.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos64.bat
Size 175B
SHA256 aa4ff93c32af3bfbf63c01272aef99e66d7766525891d821e1de26bcc4a35982
MD5 e146669c668c01f72d39190695d5824f
SHA1 cb187494e5a1834cd9aa6dbe8ed98f8406bc6027
SHA512 90272ff14a8b92ee6f42c6038c78e03c40b52c3560b4a2f879e53df6bec22af3b02edf5811fe133b4cf9888b0eae72dc96ba8a078d6cfa3d73d09cedc20cf341
TLSH
T13FC080311D01F95328191D801D649514710E115F41832DD114961473548B8DAE6B8D11
MD5 SHA1 SHA512 TLSH

Submit Download

chaos65.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos65.bat
Size 175B
SHA256 f866fa03ba26c3156e87dff62ee0c42e7eac8182f09a00cf6536003a45f0bb75
MD5 b990245bbfac78b24edc016213a19c85
SHA1 9f61e01d4f3512697e54e9d96485147513995fba
SHA512 bd3a107031551bfd452f5e4b8c7f0ed7e07f36149b374083407e9b215396ba1d53990e853e3bdfd9bfd41c42eb1a3d3266c0176a8831d20de5f12a779e1b1cb1
TLSH
T1A4C08C312D01FD53282629401DA4E66A320E01AF42832DC1188A24B2988B8EAE6BCE60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos66.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos66.bat
Size 175B
SHA256 bda1322d7eef2a29c141620b27eec3d36c1ecb9e8c4b94bddc8d92db270a0508
MD5 ee5d57965ebc7aeab595dad687bec8bd
SHA1 8f611e624489be890c9f809d30616971bcf6dbed
SHA512 7e10dae9dd9375d0bf38b56d6c56bd8e1b02e0b931bea5c8e1310014faf84dc9da1f1f49b5efc6329c9b7728d7906d74d619fb983d6cbbc76e768cf7a76c8ef4
TLSH
T1ADC08C352D05F953282629801DB4A628300D81AF4283AD8218AB6472588B8DAE6B8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos68.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos68.bat
Size 175B
SHA256 dfa820f942d4c59b75d61040b8f909d99090fddb167d7c3d0729f5d2a2aaf645
MD5 757ecaa786bf118c0bc4f3c49468b7f5
SHA1 5c86d56f9daa26f42e3522f9f46bf0696cf7f36b
SHA512 bdfd29d375062691e6ad3a82faff399132aa2888e2648ff830e6f5dd8092e3d9a95e2dcea9bf50b7b7657c1c68a585706509ebe62558be6c04d5560125f0c028
TLSH
T152C08C312E01F953282629552FB4A628300D01AF838B6E8118DB2472588B8DAEEB8E20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos7.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos7.bat
Size 172B
SHA256 753bb2aae2707de5c07c1575f6ed45bb77d7cf3338ba21c2e6ed2a079300db6d
MD5 b71aff09e2aeb11272aee832e644b98c
SHA1 aa3ab03b27696ade001e1ebf51cdda54dd5b5b83
SHA512 1d6b9060e24e8fc8d3e0f04ec9884c57cf8e8d6643bd34d236263947d72e1601a0cd9ff72330aa1bf38b14e984e5d91246228c224de6c805483501649db27b3c
TLSH
T1ABC08C312D05FD532A2509402DA49A38300D01AF42822D82388624B1589B9D9E6B9A64
MD5 SHA1 SHA512 TLSH

Submit Download

chaos74.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos74.bat
Size 175B
SHA256 a1ad1f086a93f14bbfe6bc48f66e8b56f8f88d960b6757fc826b84129571aeb4
MD5 053fc7deaedd1e5d030c66d0ce01eaea
SHA1 f0a40ee73d71487792c9d4cda97232ce53332549
SHA512 fa3f50fde4857f25ab0583ca484af30e75f28b6e454cdb43bf86e584a1f7fd91f18e9c6427eec2a1a07d6662a384bd9705bb35369b9ba7c01bf86d20f527f73a
TLSH
T12EC08C312D25FA53282909401EA496A8314D21AF42832DD21A8664B2688B9DAFAB8E21
MD5 SHA1 SHA512 TLSH

Submit Download

chaos75.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos75.bat
Size 175B
SHA256 ffef2ee67ce3e034b19b3b2ee73a5b32949dc36d1f80fc0095dfa88a93645b50
MD5 1be56134beb63231d32e1ec58f51851e
SHA1 8bf6a90047b2eb13fe6220834c5803dd02995276
SHA512 88bf4449ff1a0b05903b5dca663e3fb62b964b74dfdfa3a6ed6ab49c2f550b74fb192cd504efbdd74fdf97b360c016c64ab2cb30e911ec19d355cec5e7e55b3c
TLSH
T163C08C312D29FD53282509401DA4E668320E61AF42832DC22A8664B1988B9E9E6BCA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos76.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos76.bat
Size 175B
SHA256 fec260bcb3ced9b3f73c49222cb7d92a2e29df1dbb6ca5fb8cfacfd8f6f69bc1
MD5 0ca4cf19531d3c566468ba4d2d0ae84c
SHA1 57398188b4cd26037ddf329d73b37cf88df2ec99
SHA512 1487b6000637f4cf39a9d847084984839b47fdfa8609194d057debefca99e716e46439e7fb973f6bec46b89a94d03da90156f7ac89441f2e1ff6cc715dfcf1ef
TLSH
T121C08C352D29F953282509401DB4E6A8300DA1AF4287BD821A87A5B1588B9E9E6B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos77.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos77.bat
Size 175B
SHA256 52fa9314ed2382f9efbc8741965138e7f1562806730a8c5ba0d02e23e0edd36c
MD5 a564881d6604b484b840f2b5f9291cc6
SHA1 499d5e17daebd5d9cc979a8942b7c880eaec5904
SHA512 8a7ea0d7e319ebcda601fe56dc4b9d130ae1c32b68d76edfff2658e5b4ed38f678622a84a100fe7de5f3595168865327be6b8b7a4dd430b4fa29270b1f024093
TLSH
T1A8C08C312D29F953382519401DE49628360D21AF42836D826AD664B1588BAD9E6B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos78.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos78.bat
Size 175B
SHA256 8412c3282bc779538b27fbc562d316c99dbe4313060f3ee0ae4d7025ef3ef6db
MD5 671feffcb2debcd06aedd3c59f6d25da
SHA1 4078f0b85f1dd812ee303b7653fd5156d1bab70f
SHA512 7288d8d1e094b9c9db9efd297caed08c180896d97055c266ca2773b8f6de05a932c92cb2b3ac3e3305992cce5b5c81abd20a2430e922fa6b8a7724f252a9d95b
TLSH
T1F3C08C312E25F993382509542FB4A628300D21AF83832D821A8B65B1588B9D9EEB8A24
MD5 SHA1 SHA512 TLSH

Submit Download

chaos79.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos79.bat
Size 175B
SHA256 d0593d2944eb9b1f2cb38da3e5bb67d78440a4c333379a59518d9a07f83ef550
MD5 303532e2abc0d40c25cde7544b34438a
SHA1 b87f59ef925f827028a94550e15e6b117ac29a78
SHA512 d99f8dd3785519d172c37a8bc75f62b920abed79933bac68819921b90c97b5ad1c9ae43cc260814a7658c568aeedb863bb12a6319cebc8375e99b6adcd2e5218
TLSH
T1A9C08C316D29FD5328251D401DB4D628300D21AF46CB2D821A8664B5588B9E9E6B8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos8.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos8.bat
Size 172B
SHA256 e1e1575f0fb25e9330a9c6bcb3f8ffc380f1c44b18f757d3df2bcfc764738295
MD5 d3bc0537c76f4dd63f581269ce9248e3
SHA1 1010fc194217661191a55636276c191196d9c6b7
SHA512 5affed1cffd77bcda2c33329b56d09ac382b027a76aa6ecd4119d6472f210c04b236876c184c741f1bee46ed375acb97665efbfa4da2a38917ba0172faf90036
TLSH
T18DC08C312E01F94329150D502EB49A28300D01BF83832D81289B24B158DB8D9FAB9A24
MD5 SHA1 SHA512 TLSH

Submit Download

chaos85.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos85.bat
Size 175B
SHA256 3e5eede1cb9e6decfcc0e67a82f1b93260556f6d2d96fe80b64c34315b28bd7e
MD5 80f9b498a22919ec2f8c2a6bbc4557d6
SHA1 9a29742305e5aee371b1c4a67387cd73faabc2b1
SHA512 3a718933d2108bb39d65fceda034242b113eb84d48bf151dd22a05b67e687c3f8146c07b782bc4d4b7abd25830c28b08a62a814f0d41db0e1e4a447d17300fcd
TLSH
T180C08C356D09F943282609402DA6E668324E01AF42872EC12A9624B1988B8E9F6BCA60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos87.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos87.bat
Size 175B
SHA256 9f09f38155c8c5ca4f0e6a3e26bfc3393fa43fc29e0b057ddb4a268c7cf960cc
MD5 7ce8235096e39cb04e8047b5cd2c3e94
SHA1 6756b0bc54a775a4f95c22250c0e44b5308a3600
SHA512 4344ba7b6ca986730adfec0919e53072d74498aee8692cb061940e9d221d4f2cadabab32bc6ea1881714382994be9313c7316e58456dc2af86ea495df389a706
TLSH
T1E1C08C352D09F9633C2609402DE49A38360D01AF42836E812AD624B1588B8D9F6B8A60
MD5 SHA1 SHA512 TLSH

Submit Download

chaos89.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos89.bat
Size 175B
SHA256 1571e8fb6644c069894a00ba763df9e3cf19c52c5aca35d7fe3e95646776500f
MD5 ef979a49a5ef7eac4012d7ccc590921e
SHA1 3efb5a716ea242feaeecb400101c3905f30bd145
SHA512 d1a5e3e5b01dd2cf65d715390e64c049f123a5505e071c286757b162dd2b26f9f003478e434e76768c5d34fa38fe4136b913722db69df69b3ba296eb55929245
TLSH
T112C08C356D09FA4328261D402DB4E628300D11BF82CF2D92299624B5588F8D9FBB8A20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos9.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos9.bat
Size 172B
SHA256 1a3dc930e3b39ab5f676440721f4673e6865e952a3654ea3e9de8fe0c51da33d
MD5 57d012552a263efb0d37f567fb1b9100
SHA1 d9b77c34596ee0be9c2fd815481e6a54b95f7afe
SHA512 1f6d272d44c857753ea281fa67a1c7439cbcff66ff3f5dcee98763a202cf493ec8eed6af42da0491ab82955a20ee26bd301fa902d7458a507ad86162f94231d1
TLSH
T10FC08C312D01F9432A1609401DB4DA29300D01AF42C62D813C86A4B5589B8D9E6BEA20
MD5 SHA1 SHA512 TLSH

Submit Download

chaos95.bat

Path C:\Users\Admin\AppData\Local\Temp\chaos95.bat
Size 175B
SHA256 beff5d587594e936bf197b8e0dc80dbfa095dbb9850f84cbf235511d5e487660
MD5 0171b916a65159eea9e63e420f282be4
SHA1 026dc4b5d81287a6bca918aca6c4f3da83d5340d
SHA512 c36a9fc546ea8f6a58a4fb0d9908330d03bdbed657daf227494efe5d00270b2ff2c76ee7a896367a33e0f37f73da2b70972373e5aaa7982dcaad2ade18fff4bb
TLSH
T147C08C312D01F9432A2509402DA4E66A320E11BF42C32DC5188624B1988B8E9E6BEA70
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4720-964-0x000001942E900000-0x000001942E931000-memory.dmp

Download

memory/24320-1294-0x00000258F89B0000-0x00000258F89E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads