lockergoga | 1c479a22f8c67aa1042d3f51d7b90e336fd025b0e8004bb1a34af067ff797fbe

Analysis

max time kernel
13s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-9/crypto-locker-1.4.4.1-a9-Runtime/bin/encrypt-a9.exe
Size

1.2MB
MD5

f59c149db98488ac6b8d621a3d13aeb2
SHA1

1da2bd0c0864a2eb4fc43ca93c383e28f5ba461a
SHA256

6aa73f492b4dc52322ae8443a730c279c621a99dae4e8cb873c7a96dd4c6561f
SHA512

df8e731262c175d5a32ae5cfb8604813adae361c283c39464c9566377067fb1990466797495039d3e3a9d70324f05b47da17a2b92663cf0152321ac8634b6134
SSDEEP

24576:ieUKt2yozDn6ptlov1LGIsubFK7cjvzAwZDwisVTtk8TpQWK/:bUKthozDn6XlIFfjvz5SPTu8TpQz/

Score

10^/10

lockergoga banker ransomware trojan

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
trojan banker lockergoga
Renames multiple (585) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
920	gdeoimtf9654.exe
920	gdeoimtf9654.exe
4348	gdeoimtf9654.exe
4348	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
432	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
432	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
740	gdeoimtf9654.exe
740	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
920	gdeoimtf9654.exe
920	gdeoimtf9654.exe
4348	gdeoimtf9654.exe
4348	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
432	gdeoimtf9654.exe
432	gdeoimtf9654.exe
920	gdeoimtf9654.exe
920	gdeoimtf9654.exe
4348	gdeoimtf9654.exe
4348	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2728	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
4168	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
2352	gdeoimtf9654.exe
4168	gdeoimtf9654.exe
740	gdeoimtf9654.exe
740	gdeoimtf9654.exe
432	gdeoimtf9654.exe
432	gdeoimtf9654.exe
920	gdeoimtf9654.exe
920	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
4168	gdeoimtf9654.exe
4168	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
4168	gdeoimtf9654.exe
4168	gdeoimtf9654.exe
2380	gdeoimtf9654.exe
2380	gdeoimtf9654.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
388	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	encrypt-a9.exe
Token: SeBackupPrivilege	2244	encrypt-a9.exe
Token: SeRestorePrivilege	2244	encrypt-a9.exe
Token: SeLockMemoryPrivilege	2244	encrypt-a9.exe
Token: SeCreateGlobalPrivilege	2244	encrypt-a9.exe
Token: SeDebugPrivilege	2924	gdeoimtf9654.exe
Token: SeBackupPrivilege	2924	gdeoimtf9654.exe
Token: SeRestorePrivilege	2924	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	2924	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	2924	gdeoimtf9654.exe
Token: SeDebugPrivilege	4348	gdeoimtf9654.exe
Token: SeBackupPrivilege	4348	gdeoimtf9654.exe
Token: SeRestorePrivilege	4348	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	4348	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	4348	gdeoimtf9654.exe
Token: SeDebugPrivilege	4168	gdeoimtf9654.exe
Token: SeDebugPrivilege	432	gdeoimtf9654.exe
Token: SeDebugPrivilege	1028	gdeoimtf9654.exe
Token: SeDebugPrivilege	920	gdeoimtf9654.exe
Token: SeBackupPrivilege	4168	gdeoimtf9654.exe
Token: SeBackupPrivilege	432	gdeoimtf9654.exe
Token: SeBackupPrivilege	1028	gdeoimtf9654.exe
Token: SeBackupPrivilege	920	gdeoimtf9654.exe
Token: SeRestorePrivilege	4168	gdeoimtf9654.exe
Token: SeRestorePrivilege	1028	gdeoimtf9654.exe
Token: SeRestorePrivilege	432	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	432	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	4168	gdeoimtf9654.exe
Token: SeRestorePrivilege	920	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	1028	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	4168	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	920	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	432	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	1028	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	920	gdeoimtf9654.exe
Token: SeDebugPrivilege	740	gdeoimtf9654.exe
Token: SeBackupPrivilege	740	gdeoimtf9654.exe
Token: SeRestorePrivilege	740	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	740	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	740	gdeoimtf9654.exe
Token: SeDebugPrivilege	2380	gdeoimtf9654.exe
Token: SeBackupPrivilege	2380	gdeoimtf9654.exe
Token: SeRestorePrivilege	2380	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	2380	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	2380	gdeoimtf9654.exe
Token: SeDebugPrivilege	2728	gdeoimtf9654.exe
Token: SeBackupPrivilege	2728	gdeoimtf9654.exe
Token: SeRestorePrivilege	2728	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	2728	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	2728	gdeoimtf9654.exe
Token: SeDebugPrivilege	2352	gdeoimtf9654.exe
Token: SeBackupPrivilege	2352	gdeoimtf9654.exe
Token: SeRestorePrivilege	2352	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	2352	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	2352	gdeoimtf9654.exe
Token: SeDebugPrivilege	2596	gdeoimtf9654.exe
Token: SeBackupPrivilege	2596	gdeoimtf9654.exe
Token: SeRestorePrivilege	2596	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	2596	gdeoimtf9654.exe
Token: SeCreateGlobalPrivilege	2596	gdeoimtf9654.exe
Token: SeDebugPrivilege	1196	gdeoimtf9654.exe
Token: SeBackupPrivilege	1196	gdeoimtf9654.exe
Token: SeRestorePrivilege	1196	gdeoimtf9654.exe
Token: SeLockMemoryPrivilege	1196	gdeoimtf9654.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 388	2244	encrypt-a9.exe	82
PID 2244 wrote to memory of 388	2244	encrypt-a9.exe	82
PID 2244 wrote to memory of 2924	2244	encrypt-a9.exe	85
PID 2244 wrote to memory of 2924	2244	encrypt-a9.exe	85
PID 2244 wrote to memory of 2924	2244	encrypt-a9.exe	85
PID 2924 wrote to memory of 4348	2924	gdeoimtf9654.exe	86
PID 2924 wrote to memory of 4348	2924	gdeoimtf9654.exe	86
PID 2924 wrote to memory of 4348	2924	gdeoimtf9654.exe	86
PID 2924 wrote to memory of 920	2924	gdeoimtf9654.exe	87
PID 2924 wrote to memory of 920	2924	gdeoimtf9654.exe	87
PID 2924 wrote to memory of 920	2924	gdeoimtf9654.exe	87
PID 2924 wrote to memory of 432	2924	gdeoimtf9654.exe	88
PID 2924 wrote to memory of 432	2924	gdeoimtf9654.exe	88
PID 2924 wrote to memory of 432	2924	gdeoimtf9654.exe	88
PID 2924 wrote to memory of 4168	2924	gdeoimtf9654.exe	89
PID 2924 wrote to memory of 4168	2924	gdeoimtf9654.exe	89
PID 2924 wrote to memory of 4168	2924	gdeoimtf9654.exe	89
PID 2924 wrote to memory of 1028	2924	gdeoimtf9654.exe	90
PID 2924 wrote to memory of 1028	2924	gdeoimtf9654.exe	90
PID 2924 wrote to memory of 1028	2924	gdeoimtf9654.exe	90
PID 2924 wrote to memory of 2352	2924	gdeoimtf9654.exe	91
PID 2924 wrote to memory of 2352	2924	gdeoimtf9654.exe	91
PID 2924 wrote to memory of 2352	2924	gdeoimtf9654.exe	91
PID 2924 wrote to memory of 2728	2924	gdeoimtf9654.exe	92
PID 2924 wrote to memory of 2728	2924	gdeoimtf9654.exe	92
PID 2924 wrote to memory of 2728	2924	gdeoimtf9654.exe	92
PID 2924 wrote to memory of 2380	2924	gdeoimtf9654.exe	93
PID 2924 wrote to memory of 2380	2924	gdeoimtf9654.exe	93
PID 2924 wrote to memory of 2380	2924	gdeoimtf9654.exe	93
PID 2924 wrote to memory of 740	2924	gdeoimtf9654.exe	94
PID 2924 wrote to memory of 740	2924	gdeoimtf9654.exe	94
PID 2924 wrote to memory of 740	2924	gdeoimtf9654.exe	94
PID 2924 wrote to memory of 2596	2924	gdeoimtf9654.exe	99
PID 2924 wrote to memory of 2596	2924	gdeoimtf9654.exe	99
PID 2924 wrote to memory of 2596	2924	gdeoimtf9654.exe	99
PID 2924 wrote to memory of 1196	2924	gdeoimtf9654.exe	100
PID 2924 wrote to memory of 1196	2924	gdeoimtf9654.exe	100
PID 2924 wrote to memory of 1196	2924	gdeoimtf9654.exe	100
PID 2924 wrote to memory of 3292	2924	gdeoimtf9654.exe	101
PID 2924 wrote to memory of 3292	2924	gdeoimtf9654.exe	101
PID 2924 wrote to memory of 3292	2924	gdeoimtf9654.exe	101
PID 2924 wrote to memory of 4440	2924	gdeoimtf9654.exe	130
PID 2924 wrote to memory of 4440	2924	gdeoimtf9654.exe	130
PID 2924 wrote to memory of 4440	2924	gdeoimtf9654.exe	130
PID 2924 wrote to memory of 4940	2924	gdeoimtf9654.exe	103
PID 2924 wrote to memory of 4940	2924	gdeoimtf9654.exe	103
PID 2924 wrote to memory of 4940	2924	gdeoimtf9654.exe	103
PID 2924 wrote to memory of 1680	2924	gdeoimtf9654.exe	104
PID 2924 wrote to memory of 1680	2924	gdeoimtf9654.exe	104
PID 2924 wrote to memory of 1680	2924	gdeoimtf9654.exe	104
PID 2924 wrote to memory of 3060	2924	gdeoimtf9654.exe	105
PID 2924 wrote to memory of 3060	2924	gdeoimtf9654.exe	105
PID 2924 wrote to memory of 3060	2924	gdeoimtf9654.exe	105
PID 2924 wrote to memory of 5088	2924	gdeoimtf9654.exe	106
PID 2924 wrote to memory of 5088	2924	gdeoimtf9654.exe	106
PID 2924 wrote to memory of 5088	2924	gdeoimtf9654.exe	106
PID 2924 wrote to memory of 4072	2924	gdeoimtf9654.exe	107
PID 2924 wrote to memory of 4072	2924	gdeoimtf9654.exe	107
PID 2924 wrote to memory of 4072	2924	gdeoimtf9654.exe	107
PID 2924 wrote to memory of 4688	2924	gdeoimtf9654.exe	166
PID 2924 wrote to memory of 4688	2924	gdeoimtf9654.exe	166
PID 2924 wrote to memory of 4688	2924	gdeoimtf9654.exe	166
PID 2924 wrote to memory of 4832	2924	gdeoimtf9654.exe	109
PID 2924 wrote to memory of 4832	2924	gdeoimtf9654.exe	109

C:\Users\Admin\AppData\Local\Temp\a-9\crypto-locker-1.4.4.1-a9-Runtime\bin\encrypt-a9.exe
"C:\Users\Admin\AppData\Local\Temp\a-9\crypto-locker-1.4.4.1-a9-Runtime\bin\encrypt-a9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\a-9\crypto-locker-1.4.4.1-a9-Runtime\bin\encrypt-a9.exe C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:388
- C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
  C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3712
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1316
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1440
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:400
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:716
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:716
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:64
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3316
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2464
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:464
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:64
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:184
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4000
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:400
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3316
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1096
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1240
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:464
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:400
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3476
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:224
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:232
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3124
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2444
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4616
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe
    C:\Users\Admin\AppData\Local\Temp\gdeoimtf9654.exe -i SM-gdeoimtf -s
    3⤵
    PID:2168

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Machine.srd

Filesize
1024KB

MD5
ede5a0901d16939eedc2ae328d620eec

SHA1
4f59930d1f72e7b619c6c4514b60e05238d49fe7

SHA256
f719adc938bdf7c3e61c6185eb6217f87dd851c2c3ae4c7b7e70993b29daa2a4

SHA512
0e532159bd1fc9d9c996eef195fa50ba7920e585c132a470fb6a032f47f1cb38e9d184bea18369ee8eb63ca2223e6d547c3e671744457227d457145826848f9e

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.locked

Filesize
623KB

MD5
bc370ae965cef0c46e7864f87505476e

SHA1
522c27fb3f4ea530d4f322d7ce33079649bed927

SHA256
951b6bed51f555098a6d962b55836f662c6392981d7cf02127d84572f5b990b7

SHA512
ac2070644f71e0433b384de0d0f8664a8defdf484d2886195c33298a22de1415fcbffe4c1f5744d103f2d767aab29a239e5f118552e022078424db04c7564b8d

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
d11a44c7867a95a49fcb5a00fd94399d

SHA1
4151d13fffbe8e739cf7e4a95a14fcbbe50f2a6d

SHA256
68a3c7c306de84ee1358e478330a2c25777a19293e8463a8227e239bc882ac04

SHA512
014ab2e1f3e8344b7fe6e872f8ba1fe88d8f673b1f7425e66e4c15cf6f15853b06359acc5eb1e84fbe7bd92ff3fd2ab7d4a8ce0b5a85e5391b9cfdea3a07b3f7

Download Submit
memory/2244-1-0x0000000000A50000-0x0000000000B85000-memory.dmp

Filesize
1.2MB

Download