b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789

Analysis

max time kernel
8s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
Size 24KB
Sample260813-ne94csxtaz
SHA256 b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789
MD5 45d1bca34d6e0d7ac9976b84c594d4eb
SHA1 2ee7fd58ec6ed608a4d0817f10accec59c9afa8f
SHA512 b4de465478f808f60d7b4d75b9d9d4502c365decb7922a951175463a8af8d3711a9d696b1f4e62f26c6d607705aeb4a88b2fd63bb51a369fb68e5059e0958063
SSDEEP 384:qjD6bqVIy0xylC5LyGEbNqDmo8hIjS8tsjLR9ya5fJvwtpd2fEUgptMbzyMQB:qjDcqbYmGmymoBOzjNv5FupdYEHgb5
TLSH
T1F9B2E03CA799AEE2C38D167D87129B287F04D5918BCCCBF20421046FDBDD9A28CB450B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 40 IoCs

pid	Process
604	Rundll32.exe
3528	Rundll32.exe
2752	Rundll32.exe
3768	Rundll32.exe
2456	Rundll32.exe
4840	Rundll32.exe
4760	Rundll32.exe
5028	Rundll32.exe
2712	Rundll32.exe
3436	Rundll32.exe
3456	Rundll32.exe
4528	Rundll32.exe
1340	Rundll32.exe
3012	Rundll32.exe
5284	Rundll32.exe
3324	Rundll32.exe
2136	Rundll32.exe
2584	Rundll32.exe
3536	Rundll32.exe
5468	Rundll32.exe
1652	Rundll32.exe
716	Rundll32.exe
600	Rundll32.exe
1556	Rundll32.exe
1348	Rundll32.exe
4452	Rundll32.exe
1916	Rundll32.exe
5540	Rundll32.exe
1388	Rundll32.exe
4088	Rundll32.exe
2428	Rundll32.exe
3400	Rundll32.exe
2836	Rundll32.exe
2828	Rundll32.exe
1860	Rundll32.exe
3224	Rundll32.exe
4872	Rundll32.exe
4272	Rundll32.exe
3452	Rundll32.exe
3552	Rundll32.exe

Adds Run key to start application 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Windows\\system32\\Rundll32.exe"	Rundll32.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe
File created	C:\Windows\SysWOW64\config\Rundll32.exe	Rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
604	Rundll32.exe
604	Rundll32.exe
604	Rundll32.exe
604	Rundll32.exe
604	Rundll32.exe
604	Rundll32.exe
3528	Rundll32.exe
3528	Rundll32.exe
3528	Rundll32.exe
3528	Rundll32.exe
3528	Rundll32.exe
3528	Rundll32.exe
2752	Rundll32.exe
2752	Rundll32.exe
2752	Rundll32.exe
2752	Rundll32.exe
2752	Rundll32.exe
2752	Rundll32.exe
3768	Rundll32.exe
3768	Rundll32.exe
3768	Rundll32.exe
3768	Rundll32.exe
3768	Rundll32.exe
3768	Rundll32.exe
2456	Rundll32.exe
2456	Rundll32.exe
2456	Rundll32.exe
2456	Rundll32.exe
2456	Rundll32.exe
2456	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
604	Rundll32.exe
3528	Rundll32.exe
2752	Rundll32.exe
3768	Rundll32.exe
2456	Rundll32.exe
4840	Rundll32.exe
4840	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
4760	Rundll32.exe
5028	Rundll32.exe
2712	Rundll32.exe
2712	Rundll32.exe
2712	Rundll32.exe
3436	Rundll32.exe
3456	Rundll32.exe
3456	Rundll32.exe
4528	Rundll32.exe
4528	Rundll32.exe
1340	Rundll32.exe
3012	Rundll32.exe
5284	Rundll32.exe
3324	Rundll32.exe
3324	Rundll32.exe
2136	Rundll32.exe
2136	Rundll32.exe
2136	Rundll32.exe
2136	Rundll32.exe
2584	Rundll32.exe
2584	Rundll32.exe
2584	Rundll32.exe
3536	Rundll32.exe
5468	Rundll32.exe
5468	Rundll32.exe
1652	Rundll32.exe
1652	Rundll32.exe
716	Rundll32.exe
600	Rundll32.exe
600	Rundll32.exe
1556	Rundll32.exe
1556	Rundll32.exe
1556	Rundll32.exe
1348	Rundll32.exe
1348	Rundll32.exe
4452	Rundll32.exe
4452	Rundll32.exe
4452	Rundll32.exe
1916	Rundll32.exe
1916	Rundll32.exe
1916	Rundll32.exe
5540	Rundll32.exe
5540	Rundll32.exe
1388	Rundll32.exe
1388	Rundll32.exe
1388	Rundll32.exe
1388	Rundll32.exe
4088	Rundll32.exe
4088	Rundll32.exe
4088	Rundll32.exe
2428	Rundll32.exe
2428	Rundll32.exe
2428	Rundll32.exe
3400	Rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 604	3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe	89
PID 3620 wrote to memory of 4144	3620	b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe	90
PID 4144 wrote to memory of 2124	4144	net.exe	92
PID 604 wrote to memory of 3528	604	Rundll32.exe	93
PID 604 wrote to memory of 5828	604	Rundll32.exe	94
PID 5828 wrote to memory of 5152	5828	net.exe	96
PID 3528 wrote to memory of 2752	3528	Rundll32.exe	98
PID 3528 wrote to memory of 3744	3528	Rundll32.exe	99
PID 3744 wrote to memory of 5160	3744	net.exe	550
PID 2752 wrote to memory of 3768	2752	Rundll32.exe	103
PID 2752 wrote to memory of 1608	2752	Rundll32.exe	104
PID 1608 wrote to memory of 4124	1608	net.exe	274
PID 3768 wrote to memory of 2456	3768	Rundll32.exe	107
PID 3768 wrote to memory of 3092	3768	Rundll32.exe	108
PID 3092 wrote to memory of 3520	3092	net.exe	110
PID 2456 wrote to memory of 4840	2456	Rundll32.exe	111
PID 2456 wrote to memory of 4468	2456	Rundll32.exe	112
PID 4468 wrote to memory of 4960	4468	net.exe	547
PID 4840 wrote to memory of 4760	4840	Rundll32.exe	115
PID 4840 wrote to memory of 1108	4840	Rundll32.exe	116
PID 4840 wrote to memory of 5628	4840	Rundll32.exe	117
PID 1108 wrote to memory of 4088	1108	net.exe	279
PID 5628 wrote to memory of 2504	5628	net.exe	719
PID 4760 wrote to memory of 5028	4760	Rundll32.exe	122
PID 4760 wrote to memory of 4320	4760	Rundll32.exe	123
PID 4760 wrote to memory of 4636	4760	Rundll32.exe	124
PID 4760 wrote to memory of 836	4760	Rundll32.exe	125
PID 4636 wrote to memory of 2440	4636	net.exe	372
PID 836 wrote to memory of 3404	836	net.exe	679
PID 4320 wrote to memory of 5720	4320	net.exe	1245
PID 5028 wrote to memory of 2712	5028	Rundll32.exe	132
PID 5028 wrote to memory of 988	5028	Rundll32.exe	133
PID 988 wrote to memory of 3828	988	net.exe	805
PID 2712 wrote to memory of 3436	2712	Rundll32.exe	136
PID 2712 wrote to memory of 3240	2712	Rundll32.exe	137
PID 2712 wrote to memory of 2988	2712	Rundll32.exe	138
PID 2712 wrote to memory of 3380	2712	Rundll32.exe	139
PID 3436 wrote to memory of 3456	3436	Rundll32.exe	143
PID 2988 wrote to memory of 5124	2988	net.exe	1519
PID 3436 wrote to memory of 792	3436	Rundll32.exe	145
PID 3240 wrote to memory of 5100	3240	net.exe	1081
PID 3380 wrote to memory of 2384	3380	net.exe	448
PID 792 wrote to memory of 2956	792	net.exe	454
PID 3456 wrote to memory of 4528	3456	Rundll32.exe	150
PID 3456 wrote to memory of 1448	3456	Rundll32.exe	151
PID 3456 wrote to memory of 3288	3456	Rundll32.exe	152
PID 1448 wrote to memory of 3676	1448	net.exe	314
PID 3288 wrote to memory of 2836	3288	net.exe	312
PID 4528 wrote to memory of 1340	4528	Rundll32.exe	157
PID 4528 wrote to memory of 5392	4528	Rundll32.exe	158
PID 4528 wrote to memory of 3408	4528	Rundll32.exe	159
PID 3408 wrote to memory of 4596	3408	net.exe	949
PID 5392 wrote to memory of 4568	5392	net.exe	899
PID 1340 wrote to memory of 3012	1340	Rundll32.exe	164
PID 1340 wrote to memory of 5476	1340	Rundll32.exe	165
PID 5476 wrote to memory of 1276	5476	net.exe	397
PID 3012 wrote to memory of 5284	3012	Rundll32.exe	168
PID 3012 wrote to memory of 1624	3012	Rundll32.exe	169
PID 1624 wrote to memory of 5728	1624	net.exe	783
PID 5284 wrote to memory of 3324	5284	Rundll32.exe	172
PID 5284 wrote to memory of 4544	5284	Rundll32.exe	173
PID 4544 wrote to memory of 2904	4544	net.exe	1115
PID 3324 wrote to memory of 2136	3324	Rundll32.exe	176
PID 3324 wrote to memory of 2940	3324	Rundll32.exe	177

C:\Users\Admin\AppData\Local\Temp\b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe
"C:\Users\Admin\AppData\Local\Temp\b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\config\Rundll32.exe
  "C:\Windows\system32\config\Rundll32.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\SysWOW64\config\Rundll32.exe
    "C:\Windows\system32\config\Rundll32.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\SysWOW64\config\Rundll32.exe
      "C:\Windows\system32\config\Rundll32.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3768
      - C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:2136
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2584
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:3536
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5468
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:1652
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:716
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:600
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:1556
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1348
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:4452
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        28⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:1916
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:5540
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        30⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1388
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4088
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of FindShellTrayWindow
        
        PID:2428
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:3400
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1860
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3224
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        38⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4272
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        40⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3552
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        42⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        43⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        44⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        45⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        46⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        47⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        48⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        49⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        50⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        51⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        52⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        53⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        54⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        55⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        56⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        57⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        58⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        59⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        60⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        61⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        62⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        63⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        64⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        65⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        66⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        67⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        68⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        69⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        70⤵
        
        PID:8
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        71⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        72⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        73⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        74⤵
        
        PID:508
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        75⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        76⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        77⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        78⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        79⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        80⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        81⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        82⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        83⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        84⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        85⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        86⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        87⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        88⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        89⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        90⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        91⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        92⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        93⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        94⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        95⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        96⤵
        
        PID:952
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        97⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        98⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        99⤵
        
        PID:252
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        100⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        101⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        102⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        103⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        104⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        105⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        106⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        107⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        108⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        109⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        110⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        111⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        112⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        113⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        114⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        115⤵
        
        PID:800
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        116⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        117⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        118⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        119⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        120⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        121⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        122⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        123⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        124⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        125⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        126⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        127⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        128⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        129⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        130⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        131⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        132⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        133⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        134⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        135⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        136⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        137⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        138⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        139⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        140⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        141⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        142⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        143⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        144⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        145⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        146⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        147⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        148⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        149⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        150⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        151⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        152⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        153⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        154⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        155⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        156⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        157⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        158⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        159⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        160⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        161⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        162⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        163⤵
        
        PID:436
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        164⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        165⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        166⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        167⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        168⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        169⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        170⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        171⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        172⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        173⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        174⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        175⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        176⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        177⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        178⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        179⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        180⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        181⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        182⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        183⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        184⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        185⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        186⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        187⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        188⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        189⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        190⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        191⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        192⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        193⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        194⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        195⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        196⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        197⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        198⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        199⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        200⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        201⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        202⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        203⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        204⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        205⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        206⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        207⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        208⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        209⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        210⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        211⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\config\Rundll32.exe
        
        "C:\Windows\system32\config\Rundll32.exe"
        212⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        211⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        212⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        211⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        211⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        211⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        211⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        209⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        209⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        209⤵
        
        PID:904
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        210⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        208⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        209⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        208⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        209⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        208⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        209⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        208⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        208⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        208⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        206⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        206⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        206⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        206⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        207⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        205⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        206⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        205⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        206⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        204⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        205⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        204⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        205⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        203⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        204⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        203⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        204⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        203⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        204⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        202⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        203⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        202⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        203⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        201⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        202⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        200⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        201⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        199⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        200⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        198⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        199⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        198⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        199⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        197⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        198⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        196⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        197⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        195⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        196⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        194⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        195⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        194⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        194⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        194⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        194⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        194⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        193⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        192⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        190⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        190⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        190⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        190⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        191⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        189⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        190⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        189⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        190⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        188⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        189⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        188⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        189⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        188⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        189⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        187⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        188⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        187⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        188⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        187⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        188⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        186⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        187⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        186⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        187⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        186⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        187⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        185⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        186⤵
        
        PID:904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        185⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        186⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        184⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        185⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        183⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        184⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        183⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        184⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        182⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        183⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        182⤵
        
        PID:832
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        183⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        181⤵
        
        PID:872
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        182⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        180⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        181⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        179⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        180⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        178⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        179⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        177⤵
        
        PID:932
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        178⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        176⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        177⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        175⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        176⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        175⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        176⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        174⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        175⤵
        
        PID:832
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        174⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        175⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        173⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        174⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        172⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        173⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        171⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        172⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        171⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        172⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        170⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        171⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        169⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        170⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        168⤵
        
        PID:560
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        169⤵
        
        PID:904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        168⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        169⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        167⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        168⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        167⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        168⤵
        
        PID:872
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        166⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        167⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        166⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        167⤵
        
        PID:108
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        165⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        166⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        164⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        165⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        163⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        164⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        162⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        163⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        161⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        162⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        160⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        161⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        159⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        160⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        158⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        159⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        158⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        159⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        157⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        158⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        156⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        157⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        155⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        156⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        154⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        155⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        154⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        155⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        154⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        154⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        154⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        154⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:240
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:804
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        153⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        152⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        150⤵
        
        PID:52
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        150⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:832
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        150⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        150⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        151⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        149⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        150⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        149⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        150⤵
        
        PID:240
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        148⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        149⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        148⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        149⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        147⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        148⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        147⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        148⤵
        
        PID:436
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        147⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        148⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        146⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        147⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        146⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        147⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        145⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        146⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        144⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        145⤵
        
        PID:436
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        143⤵
        
        PID:816
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        144⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        142⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        143⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        141⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        142⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        140⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        141⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        139⤵
        
        PID:5168
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        140⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        140⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        138⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        139⤵
        
        PID:52
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        137⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        138⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        137⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        138⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        136⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        137⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        136⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        137⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        135⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        136⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        134⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        135⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        133⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        134⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        132⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        133⤵
        
        PID:816
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        131⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        132⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        130⤵
        
        PID:704
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        131⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        130⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        131⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        129⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        130⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        128⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        129⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        127⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        128⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        126⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        127⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        125⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        126⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        125⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        126⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        124⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        125⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        124⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        125⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        123⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        124⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        123⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        124⤵
        
        PID:816
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        123⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        124⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        123⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        124⤵
        
        PID:560
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        122⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        123⤵
        
        PID:108
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        122⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        123⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        121⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        122⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        121⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        122⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        120⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        121⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        119⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        120⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        119⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        120⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        118⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        119⤵
        
        PID:240
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        118⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        119⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        117⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        118⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        117⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        118⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        116⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        117⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        115⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        116⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        114⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        115⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        114⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        115⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        113⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        114⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        113⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        114⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        112⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        113⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        112⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        113⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        112⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        113⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        111⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        112⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        111⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        112⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        110⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        111⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        110⤵
        
        PID:944
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        111⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        109⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        110⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        108⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        109⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        108⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        109⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        108⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        109⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        108⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        108⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        108⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        106⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        106⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        106⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        106⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        107⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        105⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        106⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        105⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        106⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        104⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        105⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        104⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        105⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        104⤵
        
        PID:4120
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        105⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        105⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        103⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        104⤵
        
        PID:240
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        103⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        104⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        103⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        104⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        102⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        103⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        102⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        103⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        101⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        102⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        100⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        101⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        99⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        100⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        99⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        100⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        98⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        99⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        98⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        99⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        97⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        98⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        97⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        98⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        96⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        97⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        95⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        96⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        95⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        96⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        95⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        96⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        94⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        95⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        93⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        94⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        93⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        94⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        93⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        94⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        92⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        93⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        92⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        93⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        91⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        92⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        91⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        92⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        91⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        92⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        90⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        91⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        90⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        90⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:940
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        90⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        89⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        88⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        86⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        86⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        86⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        87⤵
        
        PID:560
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        85⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        86⤵
        
        PID:52
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        85⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        86⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        84⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        85⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        83⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        84⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        82⤵
        
        PID:264
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        83⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        82⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        83⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        82⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        82⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        82⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        82⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        80⤵
        
        PID:2732
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        81⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        80⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        80⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        81⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        79⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        80⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        79⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        80⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        78⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        79⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        78⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        79⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        78⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        78⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        78⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        76⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        76⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        76⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        76⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        77⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        75⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        76⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        75⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        76⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        74⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        75⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        74⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        75⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        74⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        75⤵
        
        PID:436
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        73⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        74⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        73⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        74⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        72⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        73⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        72⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        73⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        71⤵
        
        PID:828
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        72⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        70⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        71⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        69⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        70⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        68⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        69⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        67⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        68⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        66⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        67⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        66⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        67⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        65⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        66⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        65⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        66⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        64⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        65⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        63⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        64⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        63⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        64⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        62⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        63⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        62⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        63⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        61⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        62⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        60⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        61⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        59⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        60⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        58⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        59⤵
        
        PID:8
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        57⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        58⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        57⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        58⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        56⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        57⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        55⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        56⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        54⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        55⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        54⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        55⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        53⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        54⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        52⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        53⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        52⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        53⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        51⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        52⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        50⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        51⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        49⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        50⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        48⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        49⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        48⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        49⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        48⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        49⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        47⤵
        
        PID:236
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        48⤵
        
        PID:108
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        46⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        47⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        46⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        47⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        46⤵
        
        PID:908
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        47⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        45⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        46⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        45⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        46⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        45⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        46⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        44⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        45⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        44⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        45⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        43⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        44⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        43⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        44⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        43⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        43⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        43⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        41⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        41⤵
        
        PID:912
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        41⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        42⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        40⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        40⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        41⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        38⤵
        
        PID:956
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        39⤵
        
        PID:828
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        38⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        39⤵
        
        PID:108
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        37⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        38⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        36⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        37⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        36⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        
        PID:412
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        35⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        35⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        
        PID:776
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        35⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        33⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        33⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        33⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        31⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        31⤵
        
        PID:260
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        32⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        30⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        29⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        30⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        30⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        29⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        30⤵
        
        PID:816
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        28⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        29⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        29⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        27⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        28⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        27⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        28⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        26⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        26⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        26⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        27⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        25⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        26⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        26⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        24⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        25⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        24⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        24⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        22⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        21⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        22⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        21⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        
        PID:256
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        21⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        19⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:240
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        19⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        19⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        20⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        18⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        19⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        18⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        19⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        17⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5476
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        16⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        15⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        14⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        13⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        11⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        10⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        10⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        9⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5628
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        9⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        8⤵
        
        PID:4960
      - C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        7⤵
        
        PID:3520
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Windows Firewall/Internet Connection Sharing (ICS)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        6⤵
        
        PID:4124
  - - C:\Windows\SysWOW64\net.exe
      net stop "Windows Firewall/Internet Connection Sharing (ICS)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
- - C:\Windows\SysWOW64\net.exe
    net stop "Windows Firewall/Internet Connection Sharing (ICS)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
      4⤵
      PID:5152
- C:\Windows\SysWOW64\net.exe
  net stop "Windows Firewall/Internet Connection Sharing (ICS)"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
    3⤵
    PID:2124

C:\Windows\system32\rundll32.exe
C:\Windows\system32\Rundll32.exe
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rundll32.exe

Path C:\Windows\SysWOW64\config\Rundll32.exe
Size 24KB
SHA256 b35e03c19d43a31aa928305fc66135c04806fb9f1d756cf922eabc07acb3c789
MD5 45d1bca34d6e0d7ac9976b84c594d4eb
SHA1 2ee7fd58ec6ed608a4d0817f10accec59c9afa8f
SHA512 b4de465478f808f60d7b4d75b9d9d4502c365decb7922a951175463a8af8d3711a9d696b1f4e62f26c6d607705aeb4a88b2fd63bb51a369fb68e5059e0958063
SSDEEP 384:qjD6bqVIy0xylC5LyGEbNqDmo8hIjS8tsjLR9ya5fJvwtpd2fEUgptMbzyMQB:qjDcqbYmGmymoBOzjNv5FupdYEHgb5
TLSH
T1F9B2E03CA799AEE2C38D167D87129B287F04D5918BCCCBF20421046FDBDD9A28CB450B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-203-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/508-211-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/600-71-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/604-6-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/716-68-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/952-255-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1020-185-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1156-227-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1340-42-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1348-77-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1372-205-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1388-89-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1556-74-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1652-65-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1684-303-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1708-634-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1848-213-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1860-107-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1880-247-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1916-83-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2060-137-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2124-231-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2136-53-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2212-193-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2364-131-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2384-158-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2428-95-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2456-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2540-164-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2584-56-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2616-241-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2644-197-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2712-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2752-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2772-253-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2796-361-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2828-104-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2836-101-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2952-229-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2960-239-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3012-44-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3144-134-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3224-110-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3248-152-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3260-217-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3324-50-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3400-98-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3436-33-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3440-182-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3452-119-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3456-36-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3504-207-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3528-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3536-59-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3552-122-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3620-3-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3620-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3648-195-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3768-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3980-223-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4088-92-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4272-116-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4432-201-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4452-80-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4476-161-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4500-176-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4508-128-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4520-233-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4528-39-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4580-235-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4588-1642-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4600-179-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4612-155-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4692-262-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4732-209-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4760-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4840-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4872-113-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4980-188-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4984-221-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5028-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5084-225-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5268-167-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5284-47-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5288-424-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5376-143-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5440-149-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5464-219-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5468-62-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5496-146-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5520-173-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5540-86-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5584-354-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5596-191-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5644-243-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5648-237-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5772-125-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5796-215-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5916-170-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5932-251-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5944-249-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5952-140-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5956-245-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6020-199-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6204-431-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6696-518-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7052-566-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7384-663-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7404-557-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7456-699-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7640-599-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7744-586-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7768-573-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7932-710-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8188-698-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8436-885-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8472-870-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8628-731-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8700-758-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8708-944-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8760-931-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/8856-831-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/9000-821-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/9156-824-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/9660-908-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/9776-951-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/9796-1026-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/10372-1191-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/10468-1117-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/10648-1120-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/10704-1233-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/11056-1198-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/11332-1305-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/11344-1424-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/11912-1330-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/12144-1506-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/12240-1288-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/12404-1447-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/12516-1448-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/13196-1505-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/13240-1553-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/13704-1763-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/13864-1784-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/13972-1748-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/14140-1731-0x0000000000400000-0x0000000000414000-memory.dmp

Download