1c479a22f8c67aa1042d3f51d7b90e336fd025b0e8004bb1a34af067ff797fbe

Analysis

max time kernel
10s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-7/crypto-locker-1.4.4.1-a7-Runtime/bin/encrypt-a7.exe
Size

1.2MB
MD5

66b9f03ccf1b0c4b2dad55d3f60b040c
SHA1

d330988c7baf1ca42ac40a9990a5626894c628c4
SHA256

2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce
SHA512

c61a75ad69165d3ee6140553b945b2739e2380678fc2fbb0b6df4dd71fef3a3cb1d5f8edf306da119c7be36d9f19a1c6aee208b03472d0f5791ae4c591b0c47b
SSDEEP

24576:LuUKt2yozDn6ptlc71LGIsubFK7cjvzYwZDwisVTtgpTph2K/:CUKthozDn6XlAFfjvzBSPT6pTphT/

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

Renames multiple (529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\mpvis.DLL	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.schema.mfl	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_iw.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\nexturl.ort.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_gd.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_sv.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_nl.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\PackageManagementDscUtilities.strings.psd1	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.schema.mfl	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\SoftLandingAssetDark.gif	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\Logo.png.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_tr.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssci.dll.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\setup_wm.exe.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_sr-Latn-RS.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\wmlaunch.exe.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\mpvis.dll.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\WMPMediaSharing.dll.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssci.dll.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\wmplayer.exe.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssui.dll.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\mip_core.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\tt.pak.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl_DMP.xml	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\preloaded_data.pb	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsiProvider.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Edge.dat.DATA	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\msedgeupdateres_ta.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.ArchiverProviders.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.strings.psd1	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F5532BAD-6711-4562-A0FF-E4E86DCCD242}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui	fbdkdchf780.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll	fbdkdchf780.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2136	Process not Found	1613

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4688	fbdkdchf780.exe
4688	fbdkdchf780.exe
2356	fbdkdchf780.exe
2356	fbdkdchf780.exe
4868	fbdkdchf780.exe
4868	fbdkdchf780.exe
1836	fbdkdchf780.exe
1836	fbdkdchf780.exe
4496	fbdkdchf780.exe
4496	fbdkdchf780.exe
892	fbdkdchf780.exe
892	fbdkdchf780.exe
2796	fbdkdchf780.exe
2796	fbdkdchf780.exe
3452	fbdkdchf780.exe
3452	fbdkdchf780.exe
4688	fbdkdchf780.exe
4688	fbdkdchf780.exe
4836	fbdkdchf780.exe
4836	fbdkdchf780.exe
2796	fbdkdchf780.exe
2796	fbdkdchf780.exe
3452	fbdkdchf780.exe
3452	fbdkdchf780.exe
2356	fbdkdchf780.exe
2356	fbdkdchf780.exe
4868	fbdkdchf780.exe
4868	fbdkdchf780.exe
4496	fbdkdchf780.exe
4496	fbdkdchf780.exe
4688	fbdkdchf780.exe
4688	fbdkdchf780.exe
892	fbdkdchf780.exe
892	fbdkdchf780.exe
4836	fbdkdchf780.exe
4836	fbdkdchf780.exe
4496	fbdkdchf780.exe
4496	fbdkdchf780.exe
2356	fbdkdchf780.exe
2356	fbdkdchf780.exe
3452	fbdkdchf780.exe
2796	fbdkdchf780.exe
3452	fbdkdchf780.exe
2796	fbdkdchf780.exe
4868	fbdkdchf780.exe
4868	fbdkdchf780.exe
2356	fbdkdchf780.exe
2356	fbdkdchf780.exe
4496	fbdkdchf780.exe
4496	fbdkdchf780.exe
3452	fbdkdchf780.exe
3452	fbdkdchf780.exe
4688	fbdkdchf780.exe
4688	fbdkdchf780.exe
2796	fbdkdchf780.exe
2796	fbdkdchf780.exe
4836	fbdkdchf780.exe
4836	fbdkdchf780.exe
4688	fbdkdchf780.exe
4688	fbdkdchf780.exe
4868	fbdkdchf780.exe
4868	fbdkdchf780.exe
4868	fbdkdchf780.exe
4868	fbdkdchf780.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1816	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	encrypt-a7.exe
Token: SeBackupPrivilege	3528	encrypt-a7.exe
Token: SeRestorePrivilege	3528	encrypt-a7.exe
Token: SeLockMemoryPrivilege	3528	encrypt-a7.exe
Token: SeCreateGlobalPrivilege	3528	encrypt-a7.exe
Token: SeDebugPrivilege	4700	fbdkdchf780.exe
Token: SeBackupPrivilege	4700	fbdkdchf780.exe
Token: SeRestorePrivilege	4700	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	4700	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	4700	fbdkdchf780.exe
Token: SeDebugPrivilege	2356	fbdkdchf780.exe
Token: SeBackupPrivilege	2356	fbdkdchf780.exe
Token: SeRestorePrivilege	2356	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	2356	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	2356	fbdkdchf780.exe
Token: SeDebugPrivilege	892	fbdkdchf780.exe
Token: SeBackupPrivilege	892	fbdkdchf780.exe
Token: SeRestorePrivilege	892	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	892	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	892	fbdkdchf780.exe
Token: SeDebugPrivilege	4496	fbdkdchf780.exe
Token: SeDebugPrivilege	3452	fbdkdchf780.exe
Token: SeBackupPrivilege	3452	fbdkdchf780.exe
Token: SeRestorePrivilege	3452	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	3452	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	3452	fbdkdchf780.exe
Token: SeBackupPrivilege	4496	fbdkdchf780.exe
Token: SeRestorePrivilege	4496	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	4496	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	4496	fbdkdchf780.exe
Token: SeDebugPrivilege	2796	fbdkdchf780.exe
Token: SeBackupPrivilege	2796	fbdkdchf780.exe
Token: SeRestorePrivilege	2796	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	2796	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	2796	fbdkdchf780.exe
Token: SeDebugPrivilege	4836	fbdkdchf780.exe
Token: SeBackupPrivilege	4836	fbdkdchf780.exe
Token: SeRestorePrivilege	4836	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	4836	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	4836	fbdkdchf780.exe
Token: SeDebugPrivilege	4868	fbdkdchf780.exe
Token: SeBackupPrivilege	4868	fbdkdchf780.exe
Token: SeRestorePrivilege	4868	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	4868	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	4868	fbdkdchf780.exe
Token: SeDebugPrivilege	4688	fbdkdchf780.exe
Token: SeBackupPrivilege	4688	fbdkdchf780.exe
Token: SeRestorePrivilege	4688	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	4688	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	4688	fbdkdchf780.exe
Token: SeDebugPrivilege	1836	fbdkdchf780.exe
Token: SeBackupPrivilege	1836	fbdkdchf780.exe
Token: SeRestorePrivilege	1836	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	1836	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	1836	fbdkdchf780.exe
Token: SeDebugPrivilege	3664	fbdkdchf780.exe
Token: SeBackupPrivilege	3664	fbdkdchf780.exe
Token: SeRestorePrivilege	3664	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	3664	fbdkdchf780.exe
Token: SeCreateGlobalPrivilege	3664	fbdkdchf780.exe
Token: SeDebugPrivilege	1656	fbdkdchf780.exe
Token: SeBackupPrivilege	1656	fbdkdchf780.exe
Token: SeRestorePrivilege	1656	fbdkdchf780.exe
Token: SeLockMemoryPrivilege	1656	fbdkdchf780.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1816	3528	encrypt-a7.exe	83
PID 3528 wrote to memory of 1816	3528	encrypt-a7.exe	83
PID 3528 wrote to memory of 4700	3528	encrypt-a7.exe	85
PID 3528 wrote to memory of 4700	3528	encrypt-a7.exe	85
PID 3528 wrote to memory of 4700	3528	encrypt-a7.exe	85
PID 4700 wrote to memory of 4836	4700	fbdkdchf780.exe	86
PID 4700 wrote to memory of 4836	4700	fbdkdchf780.exe	86
PID 4700 wrote to memory of 4836	4700	fbdkdchf780.exe	86
PID 4700 wrote to memory of 2356	4700	fbdkdchf780.exe	87
PID 4700 wrote to memory of 2356	4700	fbdkdchf780.exe	87
PID 4700 wrote to memory of 2356	4700	fbdkdchf780.exe	87
PID 4700 wrote to memory of 892	4700	fbdkdchf780.exe	88
PID 4700 wrote to memory of 892	4700	fbdkdchf780.exe	88
PID 4700 wrote to memory of 892	4700	fbdkdchf780.exe	88
PID 4700 wrote to memory of 4496	4700	fbdkdchf780.exe	89
PID 4700 wrote to memory of 4496	4700	fbdkdchf780.exe	89
PID 4700 wrote to memory of 4496	4700	fbdkdchf780.exe	89
PID 4700 wrote to memory of 2796	4700	fbdkdchf780.exe	90
PID 4700 wrote to memory of 2796	4700	fbdkdchf780.exe	90
PID 4700 wrote to memory of 2796	4700	fbdkdchf780.exe	90
PID 4700 wrote to memory of 4868	4700	fbdkdchf780.exe	91
PID 4700 wrote to memory of 4868	4700	fbdkdchf780.exe	91
PID 4700 wrote to memory of 4868	4700	fbdkdchf780.exe	91
PID 4700 wrote to memory of 3452	4700	fbdkdchf780.exe	92
PID 4700 wrote to memory of 3452	4700	fbdkdchf780.exe	92
PID 4700 wrote to memory of 3452	4700	fbdkdchf780.exe	92
PID 4700 wrote to memory of 4688	4700	fbdkdchf780.exe	93
PID 4700 wrote to memory of 4688	4700	fbdkdchf780.exe	93
PID 4700 wrote to memory of 4688	4700	fbdkdchf780.exe	93
PID 4700 wrote to memory of 1836	4700	fbdkdchf780.exe	94
PID 4700 wrote to memory of 1836	4700	fbdkdchf780.exe	94
PID 4700 wrote to memory of 1836	4700	fbdkdchf780.exe	94
PID 4700 wrote to memory of 3664	4700	fbdkdchf780.exe	174
PID 4700 wrote to memory of 3664	4700	fbdkdchf780.exe	174
PID 4700 wrote to memory of 3664	4700	fbdkdchf780.exe	174
PID 4700 wrote to memory of 1656	4700	fbdkdchf780.exe	103
PID 4700 wrote to memory of 1656	4700	fbdkdchf780.exe	103
PID 4700 wrote to memory of 1656	4700	fbdkdchf780.exe	103
PID 4700 wrote to memory of 380	4700	fbdkdchf780.exe	104
PID 4700 wrote to memory of 380	4700	fbdkdchf780.exe	104
PID 4700 wrote to memory of 380	4700	fbdkdchf780.exe	104
PID 4700 wrote to memory of 2352	4700	fbdkdchf780.exe	105
PID 4700 wrote to memory of 2352	4700	fbdkdchf780.exe	105
PID 4700 wrote to memory of 2352	4700	fbdkdchf780.exe	105
PID 4700 wrote to memory of 3524	4700	fbdkdchf780.exe	212
PID 4700 wrote to memory of 3524	4700	fbdkdchf780.exe	212
PID 4700 wrote to memory of 3524	4700	fbdkdchf780.exe	212
PID 4700 wrote to memory of 2628	4700	fbdkdchf780.exe	107
PID 4700 wrote to memory of 2628	4700	fbdkdchf780.exe	107
PID 4700 wrote to memory of 2628	4700	fbdkdchf780.exe	107
PID 4700 wrote to memory of 2488	4700	fbdkdchf780.exe	108
PID 4700 wrote to memory of 2488	4700	fbdkdchf780.exe	108
PID 4700 wrote to memory of 2488	4700	fbdkdchf780.exe	108
PID 4700 wrote to memory of 1036	4700	fbdkdchf780.exe	256
PID 4700 wrote to memory of 1036	4700	fbdkdchf780.exe	256
PID 4700 wrote to memory of 1036	4700	fbdkdchf780.exe	256
PID 4700 wrote to memory of 2556	4700	fbdkdchf780.exe	155
PID 4700 wrote to memory of 2556	4700	fbdkdchf780.exe	155
PID 4700 wrote to memory of 2556	4700	fbdkdchf780.exe	155
PID 4700 wrote to memory of 3468	4700	fbdkdchf780.exe	624
PID 4700 wrote to memory of 3468	4700	fbdkdchf780.exe	624
PID 4700 wrote to memory of 3468	4700	fbdkdchf780.exe	624
PID 4700 wrote to memory of 4312	4700	fbdkdchf780.exe	285
PID 4700 wrote to memory of 4312	4700	fbdkdchf780.exe	285

C:\Users\Admin\AppData\Local\Temp\a-7\crypto-locker-1.4.4.1-a7-Runtime\bin\encrypt-a7.exe
"C:\Users\Admin\AppData\Local\Temp\a-7\crypto-locker-1.4.4.1-a7-Runtime\bin\encrypt-a7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\a-7\crypto-locker-1.4.4.1-a7-Runtime\bin\encrypt-a7.exe C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
  C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:380
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:464
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3068
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:456
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3068
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:456
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:732
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:512
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:732
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2068
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1012
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2140
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:512
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1012
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2068
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2068
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1012
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:456
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:512
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2920
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:512
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:456
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3068
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3888
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf780.exe -i SM-fbdkdchf -s
    3⤵
    PID:2672

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F5532BAD-6711-4562-A0FF-E4E86DCCD242}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe

Filesize
1.6MB

MD5
81717bbf89fe9dc250bc20d22868f1f8

SHA1
f4533dd7dc56c342a4161baada488f3f17a2dedc

SHA256
be062825634ab0547bd31e1306918e472bec321b032581fbdeab6f8ba2d6b1a1

SHA512
bd0ecb1eeb79586e6b4f3864cb4308a4a53cd73f605cc9d0b9691b19eb2d35aa6f146617989459d15d94ea7d6be214af4488701383c68bcc2dfda2caf93ca6d9

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
20b4d96e98ab648bd63fb8578cf759e6

SHA1
1d4406b787a66ffb774f3c142a379a03078ee82d

SHA256
dbe377a7aa25dc8e6b011dfb2ee819064da8863eb0fd94b8569eec9a5a6b6eb6

SHA512
d5623ab327ae8f3bf1ec1391d5e2b11e8fa27546c825352bcc0cc6294527bdc4d0f92397add1e67d235ef28105e110869dee9466f573e7b9994879c14fc6d5b2

Download Submit
memory/3528-1-0x0000000000AB0000-0x0000000000BE5000-memory.dmp

Filesize
1.2MB

Download