lockergoga | 1c479a22f8c67aa1042d3f51d7b90e336fd025b0e8004bb1a34af067ff797fbe

Analysis

max time kernel
32s
max time network
25s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-9/crypto-locker-1.4.4.1-a9-Runtime/bin/encrypt-a9.exe
Size

1.2MB
MD5

f59c149db98488ac6b8d621a3d13aeb2
SHA1

1da2bd0c0864a2eb4fc43ca93c383e28f5ba461a
SHA256

6aa73f492b4dc52322ae8443a730c279c621a99dae4e8cb873c7a96dd4c6561f
SHA512

df8e731262c175d5a32ae5cfb8604813adae361c283c39464c9566377067fb1990466797495039d3e3a9d70324f05b47da17a2b92663cf0152321ac8634b6134
SSDEEP

24576:ieUKt2yozDn6ptlov1LGIsubFK7cjvzAwZDwisVTtk8TpQWK/:bUKthozDn6XlIFfjvz5SPTu8TpQz/

Score

10^/10

lockergoga banker ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
trojan banker lockergoga
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2860	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2532	gdeoimtf3238.exe
2532	gdeoimtf3238.exe
2536	gdeoimtf3238.exe
2536	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2560	gdeoimtf3238.exe
2560	gdeoimtf3238.exe
2872	gdeoimtf3238.exe
2872	gdeoimtf3238.exe
2624	gdeoimtf3238.exe
2624	gdeoimtf3238.exe
2700	gdeoimtf3238.exe
2700	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2560	gdeoimtf3238.exe
2560	gdeoimtf3238.exe
2532	gdeoimtf3238.exe
2532	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2700	gdeoimtf3238.exe
2700	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2624	gdeoimtf3238.exe
2624	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2560	gdeoimtf3238.exe
2560	gdeoimtf3238.exe
2872	gdeoimtf3238.exe
2872	gdeoimtf3238.exe
2536	gdeoimtf3238.exe
2536	gdeoimtf3238.exe
2532	gdeoimtf3238.exe
2532	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2596	gdeoimtf3238.exe
2700	gdeoimtf3238.exe
2700	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2612	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2860	gdeoimtf3238.exe
2624	gdeoimtf3238.exe
2624	gdeoimtf3238.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2728	cmd.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	encrypt-a9.exe
Token: SeBackupPrivilege	2168	encrypt-a9.exe
Token: SeRestorePrivilege	2168	encrypt-a9.exe
Token: SeLockMemoryPrivilege	2168	encrypt-a9.exe
Token: SeCreateGlobalPrivilege	2168	encrypt-a9.exe
Token: SeDebugPrivilege	1044	gdeoimtf3238.exe
Token: SeBackupPrivilege	1044	gdeoimtf3238.exe
Token: SeRestorePrivilege	1044	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	1044	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	1044	gdeoimtf3238.exe
Token: SeDebugPrivilege	2536	gdeoimtf3238.exe
Token: SeBackupPrivilege	2536	gdeoimtf3238.exe
Token: SeRestorePrivilege	2536	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2536	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2536	gdeoimtf3238.exe
Token: SeDebugPrivilege	2596	gdeoimtf3238.exe
Token: SeDebugPrivilege	2700	gdeoimtf3238.exe
Token: SeDebugPrivilege	2560	gdeoimtf3238.exe
Token: SeDebugPrivilege	2624	gdeoimtf3238.exe
Token: SeBackupPrivilege	2596	gdeoimtf3238.exe
Token: SeBackupPrivilege	2700	gdeoimtf3238.exe
Token: SeBackupPrivilege	2560	gdeoimtf3238.exe
Token: SeBackupPrivilege	2624	gdeoimtf3238.exe
Token: SeRestorePrivilege	2596	gdeoimtf3238.exe
Token: SeRestorePrivilege	2700	gdeoimtf3238.exe
Token: SeRestorePrivilege	2560	gdeoimtf3238.exe
Token: SeRestorePrivilege	2624	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2596	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2700	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2560	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2624	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2596	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2700	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2560	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2624	gdeoimtf3238.exe
Token: SeDebugPrivilege	2612	gdeoimtf3238.exe
Token: SeDebugPrivilege	2872	gdeoimtf3238.exe
Token: SeDebugPrivilege	2860	gdeoimtf3238.exe
Token: SeDebugPrivilege	2532	gdeoimtf3238.exe
Token: SeBackupPrivilege	2612	gdeoimtf3238.exe
Token: SeBackupPrivilege	2872	gdeoimtf3238.exe
Token: SeBackupPrivilege	2860	gdeoimtf3238.exe
Token: SeBackupPrivilege	2532	gdeoimtf3238.exe
Token: SeRestorePrivilege	2612	gdeoimtf3238.exe
Token: SeRestorePrivilege	2860	gdeoimtf3238.exe
Token: SeRestorePrivilege	2532	gdeoimtf3238.exe
Token: SeRestorePrivilege	2872	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2872	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2872	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2612	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2532	gdeoimtf3238.exe
Token: SeLockMemoryPrivilege	2860	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2612	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2860	gdeoimtf3238.exe
Token: SeCreateGlobalPrivilege	2532	gdeoimtf3238.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2728	2168	encrypt-a9.exe	28
PID 2168 wrote to memory of 2728	2168	encrypt-a9.exe	28
PID 2168 wrote to memory of 2728	2168	encrypt-a9.exe	28
PID 2168 wrote to memory of 2728	2168	encrypt-a9.exe	28
PID 2168 wrote to memory of 1044	2168	encrypt-a9.exe	30
PID 2168 wrote to memory of 1044	2168	encrypt-a9.exe	30
PID 2168 wrote to memory of 1044	2168	encrypt-a9.exe	30
PID 2168 wrote to memory of 1044	2168	encrypt-a9.exe	30
PID 1044 wrote to memory of 2536	1044	gdeoimtf3238.exe	31
PID 1044 wrote to memory of 2536	1044	gdeoimtf3238.exe	31
PID 1044 wrote to memory of 2536	1044	gdeoimtf3238.exe	31
PID 1044 wrote to memory of 2536	1044	gdeoimtf3238.exe	31
PID 1044 wrote to memory of 2596	1044	gdeoimtf3238.exe	32
PID 1044 wrote to memory of 2596	1044	gdeoimtf3238.exe	32
PID 1044 wrote to memory of 2596	1044	gdeoimtf3238.exe	32
PID 1044 wrote to memory of 2596	1044	gdeoimtf3238.exe	32
PID 1044 wrote to memory of 2612	1044	gdeoimtf3238.exe	164
PID 1044 wrote to memory of 2612	1044	gdeoimtf3238.exe	164
PID 1044 wrote to memory of 2612	1044	gdeoimtf3238.exe	164
PID 1044 wrote to memory of 2612	1044	gdeoimtf3238.exe	164
PID 1044 wrote to memory of 2700	1044	gdeoimtf3238.exe	205
PID 1044 wrote to memory of 2700	1044	gdeoimtf3238.exe	205
PID 1044 wrote to memory of 2700	1044	gdeoimtf3238.exe	205
PID 1044 wrote to memory of 2700	1044	gdeoimtf3238.exe	205
PID 1044 wrote to memory of 2872	1044	gdeoimtf3238.exe	134
PID 1044 wrote to memory of 2872	1044	gdeoimtf3238.exe	134
PID 1044 wrote to memory of 2872	1044	gdeoimtf3238.exe	134
PID 1044 wrote to memory of 2872	1044	gdeoimtf3238.exe	134
PID 1044 wrote to memory of 2560	1044	gdeoimtf3238.exe	36
PID 1044 wrote to memory of 2560	1044	gdeoimtf3238.exe	36
PID 1044 wrote to memory of 2560	1044	gdeoimtf3238.exe	36
PID 1044 wrote to memory of 2560	1044	gdeoimtf3238.exe	36
PID 1044 wrote to memory of 2860	1044	gdeoimtf3238.exe	198
PID 1044 wrote to memory of 2860	1044	gdeoimtf3238.exe	198
PID 1044 wrote to memory of 2860	1044	gdeoimtf3238.exe	198
PID 1044 wrote to memory of 2860	1044	gdeoimtf3238.exe	198
PID 1044 wrote to memory of 2624	1044	gdeoimtf3238.exe	38
PID 1044 wrote to memory of 2624	1044	gdeoimtf3238.exe	38
PID 1044 wrote to memory of 2624	1044	gdeoimtf3238.exe	38
PID 1044 wrote to memory of 2624	1044	gdeoimtf3238.exe	38
PID 1044 wrote to memory of 2532	1044	gdeoimtf3238.exe	167
PID 1044 wrote to memory of 2532	1044	gdeoimtf3238.exe	167
PID 1044 wrote to memory of 2532	1044	gdeoimtf3238.exe	167
PID 1044 wrote to memory of 2532	1044	gdeoimtf3238.exe	167

C:\Users\Admin\AppData\Local\Temp\a-9\crypto-locker-1.4.4.1-a9-Runtime\bin\encrypt-a9.exe
"C:\Users\Admin\AppData\Local\Temp\a-9\crypto-locker-1.4.4.1-a9-Runtime\bin\encrypt-a9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\a-9\crypto-locker-1.4.4.1-a9-Runtime\bin\encrypt-a9.exe C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
  C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2464
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1012
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:284
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1256
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:412
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2140
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:344
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:384
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2124
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2760
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2220
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2276
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf3238.exe -i SM-gdeoimtf -s
    3⤵
    PID:1532

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
d11a44c7867a95a49fcb5a00fd94399d

SHA1
4151d13fffbe8e739cf7e4a95a14fcbbe50f2a6d

SHA256
68a3c7c306de84ee1358e478330a2c25777a19293e8463a8227e239bc882ac04

SHA512
014ab2e1f3e8344b7fe6e872f8ba1fe88d8f673b1f7425e66e4c15cf6f15853b06359acc5eb1e84fbe7bd92ff3fd2ab7d4a8ce0b5a85e5391b9cfdea3a07b3f7

Download Submit
memory/2168-1-0x0000000001070000-0x00000000011A5000-memory.dmp

Filesize
1.2MB

Download