xworm | 1baac16d05578f8e64687053dde830d9441cd7941cebbdda88338f1fab11fa1c

Analysis

max time kernel
143s
max time network
152s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03/12/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

زب ايلاف.exe
Size

36KB
MD5

773e091978fdcdb5f20a117c705c759e
SHA1

1f5889ac02c7e7060f7ac8772f317f2ffebdbc3c
SHA256

1baac16d05578f8e64687053dde830d9441cd7941cebbdda88338f1fab11fa1c
SHA512

017a41f88c976e51b5d73679c0c4801b30ac4a066f1b35d3846c2d1b989f464c501b74ede54ea0cf344c45d315647764b4bd939a0558bf0b73fdf630c546766d
SSDEEP

384:axTA5yOqIMtqfZD1vkSQLVxXafuYAJ7uxhXv9LzGJTiKTFFA5mpkFy7BLTQYZwn5:uTAJM/jPWzJzGdFFALFyn9CCOjh+Dqf

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

loans-hamburg.gl.at.ply.gg:48460

Mutex

LgXrKMAH0FAqHCUj

Attributes

Install_directory
%AppData%
install_file
celex.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/376-1-0x00000000007B0000-0x00000000007C0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	زب ايلاف.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\celex.lnk	زب ايلاف.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\celex.lnk	زب ايلاف.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa	cmd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4236	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4236	PING.EXE

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	376	زب ايلاف.exe
Token: SeDebugPrivilege	376	زب ايلاف.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2940	376	زب ايلاف.exe	88
PID 376 wrote to memory of 2940	376	زب ايلاف.exe	88
PID 376 wrote to memory of 4208	376	زب ايلاف.exe	91
PID 376 wrote to memory of 4208	376	زب ايلاف.exe	91
PID 4208 wrote to memory of 3040	4208	cmd.exe	93
PID 4208 wrote to memory of 3040	4208	cmd.exe	93
PID 4208 wrote to memory of 1472	4208	cmd.exe	94
PID 4208 wrote to memory of 1472	4208	cmd.exe	94
PID 376 wrote to memory of 1156	376	زب ايلاف.exe	101
PID 376 wrote to memory of 1156	376	زب ايلاف.exe	101
PID 1156 wrote to memory of 2020	1156	cmd.exe	103
PID 1156 wrote to memory of 2020	1156	cmd.exe	103
PID 376 wrote to memory of 4200	376	زب ايلاف.exe	104
PID 376 wrote to memory of 4200	376	زب ايلاف.exe	104
PID 4200 wrote to memory of 2192	4200	cmd.exe	106
PID 4200 wrote to memory of 2192	4200	cmd.exe	106
PID 2192 wrote to memory of 520	2192	net.exe	107
PID 2192 wrote to memory of 520	2192	net.exe	107
PID 4200 wrote to memory of 4440	4200	cmd.exe	108
PID 4200 wrote to memory of 4440	4200	cmd.exe	108
PID 4440 wrote to memory of 1504	4440	net.exe	109
PID 4440 wrote to memory of 1504	4440	net.exe	109
PID 4200 wrote to memory of 1460	4200	cmd.exe	110
PID 4200 wrote to memory of 1460	4200	cmd.exe	110
PID 1460 wrote to memory of 4448	1460	net.exe	111
PID 1460 wrote to memory of 4448	1460	net.exe	111
PID 4200 wrote to memory of 656	4200	cmd.exe	112
PID 4200 wrote to memory of 656	4200	cmd.exe	112
PID 656 wrote to memory of 3688	656	net.exe	113
PID 656 wrote to memory of 3688	656	net.exe	113
PID 4200 wrote to memory of 4164	4200	cmd.exe	114
PID 4200 wrote to memory of 4164	4200	cmd.exe	114
PID 4164 wrote to memory of 2056	4164	net.exe	115
PID 4164 wrote to memory of 2056	4164	net.exe	115
PID 4200 wrote to memory of 2520	4200	cmd.exe	116
PID 4200 wrote to memory of 2520	4200	cmd.exe	116
PID 2520 wrote to memory of 2748	2520	net.exe	117
PID 2520 wrote to memory of 2748	2520	net.exe	117
PID 4200 wrote to memory of 4952	4200	cmd.exe	118
PID 4200 wrote to memory of 4952	4200	cmd.exe	118
PID 4952 wrote to memory of 3736	4952	net.exe	119
PID 4952 wrote to memory of 3736	4952	net.exe	119
PID 4200 wrote to memory of 4480	4200	cmd.exe	120
PID 4200 wrote to memory of 4480	4200	cmd.exe	120
PID 4480 wrote to memory of 4944	4480	net.exe	121
PID 4480 wrote to memory of 4944	4480	net.exe	121
PID 4200 wrote to memory of 1756	4200	cmd.exe	122
PID 4200 wrote to memory of 1756	4200	cmd.exe	122
PID 1756 wrote to memory of 2440	1756	net.exe	123
PID 1756 wrote to memory of 2440	1756	net.exe	123
PID 4200 wrote to memory of 1776	4200	cmd.exe	124
PID 4200 wrote to memory of 1776	4200	cmd.exe	124
PID 1776 wrote to memory of 1376	1776	net.exe	125
PID 1776 wrote to memory of 1376	1776	net.exe	125
PID 4200 wrote to memory of 3192	4200	cmd.exe	126
PID 4200 wrote to memory of 3192	4200	cmd.exe	126
PID 3192 wrote to memory of 4860	3192	net.exe	127
PID 3192 wrote to memory of 4860	3192	net.exe	127
PID 4200 wrote to memory of 472	4200	cmd.exe	128
PID 4200 wrote to memory of 472	4200	cmd.exe	128
PID 472 wrote to memory of 3176	472	net.exe	129
PID 472 wrote to memory of 3176	472	net.exe	129
PID 4200 wrote to memory of 4700	4200	cmd.exe	130
PID 4200 wrote to memory of 4700	4200	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\زب ايلاف.exe
"C:\Users\Admin\AppData\Local\Temp\زب ايلاف.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\idoncp.bat" "
  2⤵
  - Drops file in Program Files directory
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\efajjr.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\system32\reg.exe
    reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\estfra.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" Del C:\ *.* "
    3⤵
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fumhgj.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4448
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3688
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3736
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1376
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3176
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4540
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4584
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:216
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5108
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5088
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2816
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1124
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3268
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4544
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:640
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3208
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3340
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1832
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:408
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4688
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:844
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4952
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4480
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4160
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1700
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3488
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:216
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5108
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2816
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2556
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4636
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3208
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:328
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1496
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3544
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3456
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2004
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:420
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3336
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1948
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2872
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3488
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:216
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1240
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2112
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:640
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3208
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4392
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1708
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4616
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2088
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1336
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1496
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3544
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1020
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1028
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2872
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1184
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1304
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2112
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4544
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4724
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3492
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4636
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2692
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2296
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1976
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:328
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1900
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:564
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2184
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2364
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1856
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4952
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3704
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2712
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2780
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4236
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1100
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1724
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3792
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4576
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1124
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3408
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4600
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2628
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4476
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3760
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4896
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2624
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4680
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1236
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3368
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3704
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2712
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1948
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1184
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3912
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1116
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4724
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3208
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2700
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1780
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1600
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:328
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3868
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3956
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4840
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2364
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4772
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3704
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2740
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1100
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4584
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4816
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4724
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4476
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3208
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3212
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2216
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3868
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3124
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:420
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4160
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3488
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4700
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1124
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2556
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4536
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3316
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3288
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5068
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2216
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2184
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:844
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4548
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4952
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3136
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1188
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4540
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2740
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2236
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4828
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1308
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5004
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3920
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:640
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3080
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4724
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4280
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3760
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2700
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1976
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3720
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1832
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4596
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4840
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4772
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3688
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4120
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4236
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1996
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:692
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2800
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4584
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4576
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1636
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:548
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4608
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4696
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4392
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2088
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4132
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2624
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1832
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4596
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4840
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3328
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4548
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4952
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2872
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3176
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4176
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3792
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1304
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4372
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2112
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1808
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2816
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3080
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1156
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4132
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3428
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4680
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4836
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3124
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2484
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:420
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2524
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xsnosd.bat" "
  2⤵
  PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gthgfv.bat" "
  2⤵
  PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ojstqr.bat" "
  2⤵
  PID:4808
- - C:\Windows\system32\PING.EXE
    ping localhost -n 1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cxfezr.bat" "
  2⤵
  PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsfmeu.bat" "
  2⤵
  PID:4440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4448
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4772
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1828
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5060
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3424
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4160
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1856
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1180
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4956
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4388
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5044
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4000
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2152
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1100
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2708
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:820
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2020
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1780
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4436
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2784
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3492
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:556
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2624
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4452
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:524
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:744
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4596
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3264
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3336
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4164
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4384
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2052
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4204
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1856
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4160
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1696
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4864
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1928
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1188
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1552
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2780
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2000
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4992
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4480
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3408
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4796
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4436
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3840
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3180
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3584
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4616
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4020
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:560
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:524
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1276
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3264
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3336
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3688
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2052
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4160
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5096
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4248
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1376
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3696
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2740
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:936
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3248
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3992
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1116
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:708
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2264
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5116
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1124
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4324
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1636
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1052
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3368
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3340
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:524
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3092
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2184
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1948
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2376
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3456
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1572
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1236
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1028
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1180
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3788
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4892
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1888
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2152
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4984
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2796
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2168
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3348
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:820
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1816
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1208
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2488
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5108
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1780
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3416
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4792
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4488
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3492
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3000
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3428
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3212
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3508
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3172
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3260
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2376
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:420
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vbweqk.bat" "
  2⤵
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cxfezr.bat

Filesize
64B

MD5
a9916d0bf0ac63870a4eb3a69108de6d

SHA1
9595b5f26bddafb28290fe3d3c6ff1e7e55a4409

SHA256
ae9182f1191c0335be08c69428e6dc70c9408f117e5956e678a5692aa00b2180

SHA512
fd6545f7c69e9ae2fa89a4b79ab34ee95fa6cea3e51fdeb15fe45b32781de07b59b2743b8df8781f11ccc63ef965cb45f813d8de384858734874ac4f701af302

Download Submit
C:\Users\Admin\AppData\Local\Temp\efajjr.bat

Filesize
420B

MD5
824a7bdbc0f32e6be84498f484e9346b

SHA1
0f59f00ec29e1d5d7e9b77cc40ce2afb241bd1ef

SHA256
12bf9300c346dc1d384594ce8cd9299fde0fd05ce8f20eda5ca202cbc66381ee

SHA512
d93deee70274b3b07ba3969bd5fd9748fb1a69c480c8283b1add17517aca46edd4193484564b946caf5fb5a6c03ea84f28b057af1fc7d3e825a54e69dd2b7cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\estfra.bat

Filesize
25B

MD5
b00e2f2b04ef87936edf6fb6fa5b43e4

SHA1
409ab4247d131f31bfc94df9e0bb772f724a24a3

SHA256
1aedef4185097aa0aed83a67610be9e4a65c1e74d8b80c5040c36c571004f795

SHA512
9487f9e65c73a8a999ec08f84b890914f23335fa695532f70789387994de9f0c27016ed7a2eb7471f378c6865f66ba199c88d281f194f8c3f0cccc2b347eec5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fumhgj.bat

Filesize
1KB

MD5
a3175e98e0b2b8e25e5dcda39532f638

SHA1
cb8a78e348c2d7fe7f933e69703d33a37de8b9e6

SHA256
809bc8290ef096594db222b775b159109e7230879d78a22c5d536c9b151b90fb

SHA512
b3b5caf4eca3c6c12a242492770867c23114be4eb6e267c85e1579cf19489d764c2d7452bca9dc6d3d43638ddc65ba469bf7aaad51658e9909b2c6f0c3656f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gthgfv.bat

Filesize
114B

MD5
8146b4f01b54145dc5bf3affe53f6b86

SHA1
5574dfd7e4be4e748568fa6e5a75c34065581b1e

SHA256
f219edb9a30a62ad82af352a04478aa95e34d3fb9a40334626ee4f220eee4790

SHA512
f0a118c6341e4a0aff09a986843e7424f8ae1ca6a187113fdd019c51e50a7c8aa8ef47076c48fe3a26a9381b5082b546373046b2940b9ad2e1165c4ecfb8bf1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\idoncp.bat

Filesize
62B

MD5
7645c582f90471d7d236f93ff20095a4

SHA1
db262d594dfa4dff1787074c28cea3e97ee1fd6f

SHA256
5864198fb4149fbd67a956a6ffba845f5cfd19ad9c288885d8fe78491df78044

SHA512
c088118e7915b73733f0b7e067c230b07417ca47c8a10a6b9c382d0df912fa116381c6e6c25e0881d4eff86a6b7f527802f3e08c8f7f47b03dac058d06ae170c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ojstqr.bat

Filesize
796B

MD5
0422ce7346866d7df2861f210238deba

SHA1
60eddf57d55fbd1e38da8302bf8f0badd55dbed7

SHA256
3ee95bd572e8e74bc6f69aeb063faf2caca9830edc28bcd6049744056e6b6447

SHA512
b3d4d5553e8ffce5e31723d493d13e625dbf54bc8477fff641af820eee8a3b8f22e026405a1cfd35ba4d5309acd2662a950ac3d45ba98999a4e3311020cc5330

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsfmeu.bat

Filesize
76B

MD5
b79f4629937094b6e5601ac0a5a6b57c

SHA1
cec1e4fa729192d298b726a422670e32db36046d

SHA256
41dae4a8ac276537dfb77197a325a9b16b8f8f665c8ed46c87e96adcbfd187a6

SHA512
070df2eb8fa8a3ef06b008843b1e66d8375951a47036157fff85f6b8c9a427f7d23e5033d72f8841ff1c018dd01a2e433b3d3671d3b979300a9dfb0a2e9c1c80

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

Filesize
49B

MD5
cfb046d3c9513b92c1b287da26f97c28

SHA1
ea8208c4dad826b7fdb3b5b728863a95e86d4383

SHA256
a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b

SHA512
dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340

Download Submit
C:\Users\Admin\AppData\Local\Temp\xsnosd.bat

Filesize
41B

MD5
c1d398ee95eab80dccc943be63c795b5

SHA1
d8cc1cac5878fdbed1e58cb7a8decff008f8bed5

SHA256
e7d4ecd60d7c1b163bfaf66170a3a1fd41ea58afc5d00a458e2e03ed332ace26

SHA512
9eb8b80ba60268ea40ff2c934f660add3e705390f178d026c902754f23b64d475ec3a9dc460c83c5cb728443ac2445013f10001669f3274885dab29fcc565e6e

Download Submit
memory/376-8-0x00007FFA21040000-0x00007FFA21B02000-memory.dmp

Filesize
10.8MB

Download
memory/376-34-0x000000001D930000-0x000000001D93C000-memory.dmp

Filesize
48KB

Download
memory/376-0-0x00007FFA21043000-0x00007FFA21045000-memory.dmp

Filesize
8KB

Download
memory/376-7-0x00007FFA21043000-0x00007FFA21045000-memory.dmp

Filesize
8KB

Download
memory/376-2-0x00007FFA21040000-0x00007FFA21B02000-memory.dmp

Filesize
10.8MB

Download
memory/376-1-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download