xworm | 1baac16d05578f8e64687053dde830d9441cd7941cebbdda88338f1fab11fa1c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.exe
Size

36KB
MD5

773e091978fdcdb5f20a117c705c759e
SHA1

1f5889ac02c7e7060f7ac8772f317f2ffebdbc3c
SHA256

1baac16d05578f8e64687053dde830d9441cd7941cebbdda88338f1fab11fa1c
SHA512

017a41f88c976e51b5d73679c0c4801b30ac4a066f1b35d3846c2d1b989f464c501b74ede54ea0cf344c45d315647764b4bd939a0558bf0b73fdf630c546766d
SSDEEP

384:axTA5yOqIMtqfZD1vkSQLVxXafuYAJ7uxhXv9LzGJTiKTFFA5mpkFy7BLTQYZwn5:uTAJM/jPWzJzGdFFALFyn9CCOjh+Dqf

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

loans-hamburg.gl.at.ply.gg:48460

Mutex

LgXrKMAH0FAqHCUj

Attributes

Install_directory
%AppData%
install_file
celex.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/832-1-0x0000000000FB0000-0x0000000000FC0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	.exe

Drops startup file 2 IoCs

Processes:

.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\celex.lnk	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\celex.lnk	.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
14	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

.exeAUDIODG.EXE

description	pid	Process
Token: SeDebugPrivilege	832	.exe
Token: SeDebugPrivilege	832	.exe
Token: 33	1640	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1640	AUDIODG.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	Process	procid_target
PID 832 wrote to memory of 2840	832	.exe	93
PID 832 wrote to memory of 2840	832	.exe	93
PID 2840 wrote to memory of 4316	2840	cmd.exe	95
PID 2840 wrote to memory of 4316	2840	cmd.exe	95
PID 4316 wrote to memory of 1956	4316	net.exe	96
PID 4316 wrote to memory of 1956	4316	net.exe	96
PID 2840 wrote to memory of 5000	2840	cmd.exe	97
PID 2840 wrote to memory of 5000	2840	cmd.exe	97
PID 5000 wrote to memory of 1444	5000	net.exe	98
PID 5000 wrote to memory of 1444	5000	net.exe	98
PID 2840 wrote to memory of 4656	2840	cmd.exe	99
PID 2840 wrote to memory of 4656	2840	cmd.exe	99
PID 4656 wrote to memory of 1668	4656	net.exe	100
PID 4656 wrote to memory of 1668	4656	net.exe	100
PID 2840 wrote to memory of 4404	2840	cmd.exe	101
PID 2840 wrote to memory of 4404	2840	cmd.exe	101
PID 4404 wrote to memory of 2824	4404	net.exe	102
PID 4404 wrote to memory of 2824	4404	net.exe	102
PID 2840 wrote to memory of 1248	2840	cmd.exe	103
PID 2840 wrote to memory of 1248	2840	cmd.exe	103
PID 1248 wrote to memory of 4680	1248	net.exe	104
PID 1248 wrote to memory of 4680	1248	net.exe	104
PID 2840 wrote to memory of 4260	2840	cmd.exe	105
PID 2840 wrote to memory of 4260	2840	cmd.exe	105
PID 4260 wrote to memory of 4928	4260	net.exe	106
PID 4260 wrote to memory of 4928	4260	net.exe	106
PID 2840 wrote to memory of 1584	2840	cmd.exe	107
PID 2840 wrote to memory of 1584	2840	cmd.exe	107
PID 1584 wrote to memory of 4480	1584	net.exe	108
PID 1584 wrote to memory of 4480	1584	net.exe	108
PID 2840 wrote to memory of 1460	2840	cmd.exe	109
PID 2840 wrote to memory of 1460	2840	cmd.exe	109
PID 1460 wrote to memory of 3532	1460	net.exe	110
PID 1460 wrote to memory of 3532	1460	net.exe	110
PID 2840 wrote to memory of 4948	2840	cmd.exe	111
PID 2840 wrote to memory of 4948	2840	cmd.exe	111
PID 4948 wrote to memory of 1424	4948	net.exe	112
PID 4948 wrote to memory of 1424	4948	net.exe	112
PID 2840 wrote to memory of 232	2840	cmd.exe	113
PID 2840 wrote to memory of 232	2840	cmd.exe	113
PID 232 wrote to memory of 4988	232	net.exe	114
PID 232 wrote to memory of 4988	232	net.exe	114
PID 2840 wrote to memory of 4136	2840	cmd.exe	115
PID 2840 wrote to memory of 4136	2840	cmd.exe	115
PID 4136 wrote to memory of 3884	4136	net.exe	116
PID 4136 wrote to memory of 3884	4136	net.exe	116
PID 2840 wrote to memory of 3104	2840	cmd.exe	117
PID 2840 wrote to memory of 3104	2840	cmd.exe	117
PID 3104 wrote to memory of 1776	3104	net.exe	118
PID 3104 wrote to memory of 1776	3104	net.exe	118
PID 2840 wrote to memory of 208	2840	cmd.exe	119
PID 2840 wrote to memory of 208	2840	cmd.exe	119
PID 208 wrote to memory of 764	208	net.exe	120
PID 208 wrote to memory of 764	208	net.exe	120
PID 2840 wrote to memory of 2208	2840	cmd.exe	121
PID 2840 wrote to memory of 2208	2840	cmd.exe	121
PID 2208 wrote to memory of 2676	2208	net.exe	122
PID 2208 wrote to memory of 2676	2208	net.exe	122
PID 2840 wrote to memory of 5068	2840	cmd.exe	123
PID 2840 wrote to memory of 5068	2840	cmd.exe	123
PID 5068 wrote to memory of 2988	5068	net.exe	124
PID 5068 wrote to memory of 2988	5068	net.exe	124
PID 2840 wrote to memory of 2344	2840	cmd.exe	125
PID 2840 wrote to memory of 2344	2840	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\.exe
"C:\Users\Admin\AppData\Local\Temp\.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wscuqa.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1956
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4680
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4928
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4480
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3532
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1424
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4988
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3884
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:764
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2988
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3960
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2324
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3580
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1012
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2168
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4224
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1148
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3664
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4256
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2352
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5024
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1960
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1844
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4304
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3988
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1404
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1156
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2200
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1864
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3928
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1580
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1948
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1048
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4564
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1160
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2852
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4240
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3120
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4088
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:228
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:680
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4340
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1596
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3588
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3580
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1280
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4732
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4900
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1960
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5024
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1844
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1164
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1404
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1156
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4048
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4924
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1284
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3220
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1948
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3228
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:412
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:556
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:552
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3896
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2784
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4852
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4808
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3756
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5016
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3964
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4424
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4088
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1348
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:228
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:764
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2364
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2988
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2424
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1152
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2300
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4064
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1012
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1848
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:828
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4508
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4256
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4500
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4640
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2232
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:876
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3456
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:892
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1864
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1600
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4272
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1284
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1948
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3600
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3240
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2712
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:456
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4928
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4840
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3120
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3428
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2828
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2688
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2588
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2572
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3960
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2908
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2692
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:408
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1280
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2868
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3976
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2240
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4772
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5116
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4500
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4472
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4264
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2232
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4436
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1256
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4428
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1608
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2192
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4884
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1028
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:552
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3820
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:556
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4316
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:456
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4372
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2892
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4496
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1412
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3368
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3064
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2344
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4788
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4568
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5084
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2432
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2296
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1012
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4536
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4732
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1612
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2524
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1844
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:112
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1164
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2756
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1656
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4876
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3996
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3896
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1396
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:640
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2172
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4404
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2592
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4424
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2452
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1348
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:180
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2140
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2364
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4484
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2684
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4216
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2692
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2632
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1148
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4860
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4508
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:476
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2188
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1432
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4780
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3340
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2852
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2476
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3212
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1636
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1284
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4624
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1048
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1160
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3436
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4056
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2172
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2712
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4344
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2892
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4424
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1584
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:232
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3368
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4136
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3188
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3584
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4788
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5060
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2072
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:372
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2432
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:408
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3108
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4536
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2480
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1036
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3224
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2212
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4304
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4032
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2176
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:768
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1256
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4220
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2012
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4048
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4864
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3228
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3508
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4876
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3548
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:552
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2784
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3900
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4652
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4344
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3380
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3464
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4480
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3428
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2804
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1348
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3064
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1852
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1880
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1416
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2072
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3588
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4856
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:408
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2816
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3152
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1356
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2240
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2624
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:928
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3336
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1592
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4872
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4920
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2368
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1864
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2328
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4168
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3968
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1028
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4564
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2356
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2352
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1396
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3320
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4808
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4404
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2464
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2452
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:232
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5004
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4000
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2272
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3332
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4788
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1416
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2908
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:416
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3504
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3588
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2692
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1848
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2632
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3108
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4732
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4936
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4288
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:828
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3440
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3140
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1516
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1164
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4396
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1156
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3212
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1256
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1728
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2716
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3928
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1048
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4876
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2356
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3436
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3900
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2824
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4248
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2892
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4496
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3884
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4988
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4904
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3992
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2988
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2300
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3368
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4664
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4912
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5084
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3360
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1280
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2444
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3152
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2864
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4772
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3976
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:184
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1660
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1940
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3792
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3340
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2212
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3640
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2128
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2852
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2476
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3040
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1248
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4168
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3228
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4624
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3996
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3748
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3892
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2172
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3900
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4464
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4680
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4404
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2984
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2452
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3676
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1412
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:544
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2252
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2140
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4992
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3332
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4484
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5052
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:5012
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3960
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3776
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3044
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2324
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3588
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1012
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2496
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2112
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3152
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4284
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4288
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4672
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3224
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2668
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1592
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4400
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2128
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1156
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1568
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4272
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1284
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4556
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1160
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4316
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:412
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4812
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4520
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2784
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4752
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4980
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4680
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1460
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3620
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3984
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:232
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2664
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4644
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:764
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2688
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:820
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1852
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:4788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1956
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:3944
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:3368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:4140
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2760
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:5096
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2072
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:1740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1648
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2432
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:1324
- - C:\Windows\system32\net.exe
    net send * WORKGROUP ENABLED
    3⤵
    PID:2868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 send * WORKGROUP ENABLED
      4⤵
      PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uaklwp.bat" "
  2⤵
  PID:2644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x420 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uaklwp.bat

Filesize
1KB

MD5
dc635e7655d5830e9c0c82e1e1d4fc75

SHA1
ef2c7b40ee950aa88fc7a81d5496e03c1ff3bb9f

SHA256
4e6cfe80de249ffd28981228be838349c8fff904560d4afbff3c7a1b1cfbc144

SHA512
802fab46148debd7b962c652a37695aba395104b8ca097f34e6151323eb4560261653b8543e7a5ca89f798bd125a8cc1cee2eab08384c780826031997632a274

Download Submit
C:\Users\Admin\AppData\Local\Temp\wscuqa.bat

Filesize
1KB

MD5
a3175e98e0b2b8e25e5dcda39532f638

SHA1
cb8a78e348c2d7fe7f933e69703d33a37de8b9e6

SHA256
809bc8290ef096594db222b775b159109e7230879d78a22c5d536c9b151b90fb

SHA512
b3b5caf4eca3c6c12a242492770867c23114be4eb6e267c85e1579cf19489d764c2d7452bca9dc6d3d43638ddc65ba469bf7aaad51658e9909b2c6f0c3656f6b

Download Submit
memory/832-0-0x00007FF816963000-0x00007FF816965000-memory.dmp

Filesize
8KB

Download
memory/832-1-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/832-2-0x00007FF816960000-0x00007FF817421000-memory.dmp

Filesize
10.8MB

Download
memory/832-7-0x00007FF816963000-0x00007FF816965000-memory.dmp

Filesize
8KB

Download
memory/832-8-0x00007FF816960000-0x00007FF817421000-memory.dmp

Filesize
10.8MB

Download
memory/832-10-0x000000001BCB0000-0x000000001BD3E000-memory.dmp

Filesize
568KB

Download
memory/832-15-0x000000001E560000-0x000000001E56C000-memory.dmp

Filesize
48KB

Download