ebc2d7d93d9ab3149600a404723800e4966198074001f0b6708ddac29fe573e1

Analysis

max time kernel
150s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/03/2023, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06c1c3c63a976462f1e561a446a84a91.exe
Size

564KB
MD5

06c1c3c63a976462f1e561a446a84a91
SHA1

1892b56de0be7db83aa0e181fd72b454f42f3c84
SHA256

ebc2d7d93d9ab3149600a404723800e4966198074001f0b6708ddac29fe573e1
SHA512

19142089d71a7e5165f7389a643ff2bd3aa307859c0aa2a9ad8ee1ab2be0d9642c78651ff141402d67734993d1a68afb42903cea4d810163eff7cb65645c97e9
SSDEEP

12288:/YpdTHOHf/NRp/2mifXpS4ux89VQ6hPdUYrFWiQUVw30:/YpFuHfvp/SPY4uxeQsyYrEDUVw30

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1928	sfnecrcoz.exe
960	sfnecrcoz.exe
1792	sfnecrcoz.exe
756	sfnecrcoz.exe
1748	sfnecrcoz.exe
588	sfnecrcoz.exe
320	sfnecrcoz.exe
1256	sfnecrcoz.exe
2012	sfnecrcoz.exe
1164	sfnecrcoz.exe
940	sfnecrcoz.exe
1168	sfnecrcoz.exe
1484	sfnecrcoz.exe
1764	sfnecrcoz.exe
1588	sfnecrcoz.exe
1280	sfnecrcoz.exe
832	sfnecrcoz.exe
1284	sfnecrcoz.exe
1216	sfnecrcoz.exe
1872	sfnecrcoz.exe
1880	sfnecrcoz.exe
1892	sfnecrcoz.exe
1888	sfnecrcoz.exe
2040	sfnecrcoz.exe
1720	sfnecrcoz.exe
852	sfnecrcoz.exe
1628	sfnecrcoz.exe
1896	sfnecrcoz.exe
1780	sfnecrcoz.exe
1616	sfnecrcoz.exe
916	sfnecrcoz.exe
1664	sfnecrcoz.exe
964	sfnecrcoz.exe
928	sfnecrcoz.exe
1988	sfnecrcoz.exe
1992	sfnecrcoz.exe
1668	sfnecrcoz.exe
1884	sfnecrcoz.exe
1392	sfnecrcoz.exe
1964	sfnecrcoz.exe
1920	sfnecrcoz.exe
896	sfnecrcoz.exe
868	sfnecrcoz.exe
544	sfnecrcoz.exe
1508	sfnecrcoz.exe
1532	sfnecrcoz.exe
1804	sfnecrcoz.exe
1636	sfnecrcoz.exe
560	sfnecrcoz.exe
1416	sfnecrcoz.exe
960	sfnecrcoz.exe
840	sfnecrcoz.exe
672	sfnecrcoz.exe
1792	sfnecrcoz.exe
1692	sfnecrcoz.exe
756	sfnecrcoz.exe
1116	sfnecrcoz.exe
1748	sfnecrcoz.exe
1544	sfnecrcoz.exe
588	sfnecrcoz.exe
1844	sfnecrcoz.exe
320	sfnecrcoz.exe
1688	sfnecrcoz.exe
1256	sfnecrcoz.exe

Loads dropped DLL 64 IoCs

pid	Process
1972	06c1c3c63a976462f1e561a446a84a91.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1928	sfnecrcoz.exe
1928	sfnecrcoz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1928	1972	06c1c3c63a976462f1e561a446a84a91.exe	27
PID 1972 wrote to memory of 1928	1972	06c1c3c63a976462f1e561a446a84a91.exe	27
PID 1972 wrote to memory of 1928	1972	06c1c3c63a976462f1e561a446a84a91.exe	27
PID 1972 wrote to memory of 1928	1972	06c1c3c63a976462f1e561a446a84a91.exe	27
PID 1928 wrote to memory of 960	1928	sfnecrcoz.exe	28
PID 1928 wrote to memory of 960	1928	sfnecrcoz.exe	28
PID 1928 wrote to memory of 960	1928	sfnecrcoz.exe	28
PID 1928 wrote to memory of 960	1928	sfnecrcoz.exe	28
PID 1928 wrote to memory of 1792	1928	sfnecrcoz.exe	29
PID 1928 wrote to memory of 1792	1928	sfnecrcoz.exe	29
PID 1928 wrote to memory of 1792	1928	sfnecrcoz.exe	29
PID 1928 wrote to memory of 1792	1928	sfnecrcoz.exe	29
PID 1928 wrote to memory of 756	1928	sfnecrcoz.exe	30
PID 1928 wrote to memory of 756	1928	sfnecrcoz.exe	30
PID 1928 wrote to memory of 756	1928	sfnecrcoz.exe	30
PID 1928 wrote to memory of 756	1928	sfnecrcoz.exe	30
PID 1928 wrote to memory of 1748	1928	sfnecrcoz.exe	31
PID 1928 wrote to memory of 1748	1928	sfnecrcoz.exe	31
PID 1928 wrote to memory of 1748	1928	sfnecrcoz.exe	31
PID 1928 wrote to memory of 1748	1928	sfnecrcoz.exe	31
PID 1928 wrote to memory of 588	1928	sfnecrcoz.exe	32
PID 1928 wrote to memory of 588	1928	sfnecrcoz.exe	32
PID 1928 wrote to memory of 588	1928	sfnecrcoz.exe	32
PID 1928 wrote to memory of 588	1928	sfnecrcoz.exe	32
PID 1928 wrote to memory of 320	1928	sfnecrcoz.exe	33
PID 1928 wrote to memory of 320	1928	sfnecrcoz.exe	33
PID 1928 wrote to memory of 320	1928	sfnecrcoz.exe	33
PID 1928 wrote to memory of 320	1928	sfnecrcoz.exe	33
PID 1928 wrote to memory of 1256	1928	sfnecrcoz.exe	34
PID 1928 wrote to memory of 1256	1928	sfnecrcoz.exe	34
PID 1928 wrote to memory of 1256	1928	sfnecrcoz.exe	34
PID 1928 wrote to memory of 1256	1928	sfnecrcoz.exe	34
PID 1928 wrote to memory of 2012	1928	sfnecrcoz.exe	35
PID 1928 wrote to memory of 2012	1928	sfnecrcoz.exe	35
PID 1928 wrote to memory of 2012	1928	sfnecrcoz.exe	35
PID 1928 wrote to memory of 2012	1928	sfnecrcoz.exe	35
PID 1928 wrote to memory of 1164	1928	sfnecrcoz.exe	36
PID 1928 wrote to memory of 1164	1928	sfnecrcoz.exe	36
PID 1928 wrote to memory of 1164	1928	sfnecrcoz.exe	36
PID 1928 wrote to memory of 1164	1928	sfnecrcoz.exe	36
PID 1928 wrote to memory of 940	1928	sfnecrcoz.exe	37
PID 1928 wrote to memory of 940	1928	sfnecrcoz.exe	37
PID 1928 wrote to memory of 940	1928	sfnecrcoz.exe	37
PID 1928 wrote to memory of 940	1928	sfnecrcoz.exe	37
PID 1928 wrote to memory of 1168	1928	sfnecrcoz.exe	38
PID 1928 wrote to memory of 1168	1928	sfnecrcoz.exe	38
PID 1928 wrote to memory of 1168	1928	sfnecrcoz.exe	38
PID 1928 wrote to memory of 1168	1928	sfnecrcoz.exe	38
PID 1928 wrote to memory of 1484	1928	sfnecrcoz.exe	39
PID 1928 wrote to memory of 1484	1928	sfnecrcoz.exe	39
PID 1928 wrote to memory of 1484	1928	sfnecrcoz.exe	39
PID 1928 wrote to memory of 1484	1928	sfnecrcoz.exe	39
PID 1928 wrote to memory of 1764	1928	sfnecrcoz.exe	40
PID 1928 wrote to memory of 1764	1928	sfnecrcoz.exe	40
PID 1928 wrote to memory of 1764	1928	sfnecrcoz.exe	40
PID 1928 wrote to memory of 1764	1928	sfnecrcoz.exe	40
PID 1928 wrote to memory of 1588	1928	sfnecrcoz.exe	41
PID 1928 wrote to memory of 1588	1928	sfnecrcoz.exe	41
PID 1928 wrote to memory of 1588	1928	sfnecrcoz.exe	41
PID 1928 wrote to memory of 1588	1928	sfnecrcoz.exe	41
PID 1928 wrote to memory of 1280	1928	sfnecrcoz.exe	42
PID 1928 wrote to memory of 1280	1928	sfnecrcoz.exe	42
PID 1928 wrote to memory of 1280	1928	sfnecrcoz.exe	42
PID 1928 wrote to memory of 1280	1928	sfnecrcoz.exe	42

C:\Users\Admin\AppData\Local\Temp\06c1c3c63a976462f1e561a446a84a91.exe
"C:\Users\Admin\AppData\Local\Temp\06c1c3c63a976462f1e561a446a84a91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
  "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe" "C:\Users\Admin\AppData\Local\Temp\wgfftirg.au3"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    - Executes dropped EXE
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:652
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1464
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1276
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1904
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe
    "C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe"
    3⤵
    PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csnjcym.mrz

Filesize
140KB

MD5
6a5797696f897f3ed2a7d9168b1de8a9

SHA1
d6f4212e39a9965fc19b2f4bf00449a1e0e7c16e

SHA256
f6cea74ba21a81f519200aefe8b2fc64528867bd495970e31db425c0d8ccbcdb

SHA512
9074635c436af3e70ae532e7d314fd9b9988d5273c7599fea0738dbf9d8aec06c6f92ac2fd8b0d62f551ad57858974a72b743c30da271e39a99c985f9d67a2f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlmvon.wjn

Filesize
50KB

MD5
cdf886f6d0630f3f4ec70ecdc005a55b

SHA1
dd024f7f56ffc04fb1ce930e0f5ccc8fdb714559

SHA256
f59a0ce67e0432bb8b28b16fb1933d163c97cbe55f4bf7c982a1f234103924e3

SHA512
3e7a6039583b0cb2ee9bb2fece2f0404f9d598765f0e12488f0a8398b93c7b749ccd6637f3f3bdbecb3e0155934418ea340c94fc79e1c2f95fcc4e6961c43efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wgfftirg.au3

Filesize
3KB

MD5
cb6d7b45f629ffca88afbda5a948a3d0

SHA1
4bfbb742eeee8bf354c56fa13b2ce36f8f852f02

SHA256
4848d071573423293be114fb4519fd3d601ee0b6ca19030fece4f4f6fed1707f

SHA512
588b5bd3605f62555123800e6e3bad1780264b28c4a4cd07bdb2f38e17a6ffa5e4d0a7e0f69b3b1ef948dbdbb9b0e5751eaac01d415aa7c4d8536382c73f44ba

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\sfnecrcoz.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/1928-67-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/1928-128-0x0000000002640000-0x000000000271F000-memory.dmp

Filesize
892KB

Download