lockergoga | 1c479a22f8c67aa1042d3f51d7b90e336fd025b0e8004bb1a34af067ff797fbe

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-8/crypto-locker-1.4.4.1-a8-Runtime/bin/encrypt-a8.exe
Size

1.2MB
MD5

d31b5a2c8a26296a207a1528ee6d9258
SHA1

9a2a152dee5276ad5dd8340fa8a59025754f7b6d
SHA256

d866e83d3f09768f47133eb94050dafff597631a9b1894e6cfe7174d23a4528f
SHA512

7b79dda826f4fafbcd19437da1a42b26442e44c6d51e52c36e5804f9705380ff3fe626a94788876076701d38443d521fe195218d1d5c0acdf95595cab666e642
SSDEEP

24576:buUKt2yozDn6ptlc71LGIsubFK7cjvzYwZDwisVTtgATpbpK/:SUKthozDn6XlAFfjvzBSPT6ATpbc/

Score

10^/10

lockergoga banker ransomware trojan

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Signatures

LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
trojan banker lockergoga
Renames multiple (517) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.ArchiverProviders.resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.Tests.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\uk-UA\wmpnssui.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Be.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunch.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateHorizontallyOverlay.png	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.psm1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.strings.psd1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotMatch.snippets.ps1xml	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\BlogThumbnail.png	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\wordpad.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.CoreProviders.resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\PSGet.Resource.psd1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\wmlaunch.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\README.md	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\ContainExactly.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotThrow.snippets.ps1xml	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\mpvis.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Resource.psd1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Exist.Tests.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\uk-UA\mpvis.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\wmpnssci.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Rotate.png	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\SetupTeardown.Tests.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\chocolateyInstall.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Coverage.Tests.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssci.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\Example2.Diagnostics.Tests.ps1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\MSFT_PackageManagementSource.strings.psd1	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\wmlaunch.exe.mui	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Microsoft.PackageManagement.resources.dll	qwnuwcdt7103.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Icons.ttf	qwnuwcdt7103.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Set-TestInconclusive.ps1	qwnuwcdt7103.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3140	qwnuwcdt7103.exe
3140	qwnuwcdt7103.exe
3140	qwnuwcdt7103.exe
3140	qwnuwcdt7103.exe
4996	qwnuwcdt7103.exe
4996	qwnuwcdt7103.exe
4844	qwnuwcdt7103.exe
4844	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
2780	qwnuwcdt7103.exe
2780	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
4996	qwnuwcdt7103.exe
4996	qwnuwcdt7103.exe
2780	qwnuwcdt7103.exe
2780	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
2780	qwnuwcdt7103.exe
2780	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
3304	qwnuwcdt7103.exe
4844	qwnuwcdt7103.exe
4844	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
3184	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
960	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
5096	qwnuwcdt7103.exe
3140	qwnuwcdt7103.exe
3140	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe
1100	qwnuwcdt7103.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1560	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	encrypt-a8.exe
Token: SeBackupPrivilege	1324	encrypt-a8.exe
Token: SeRestorePrivilege	1324	encrypt-a8.exe
Token: SeLockMemoryPrivilege	1324	encrypt-a8.exe
Token: SeCreateGlobalPrivilege	1324	encrypt-a8.exe
Token: SeDebugPrivilege	4392	qwnuwcdt7103.exe
Token: SeBackupPrivilege	4392	qwnuwcdt7103.exe
Token: SeRestorePrivilege	4392	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	4392	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	4392	qwnuwcdt7103.exe
Token: SeDebugPrivilege	1100	qwnuwcdt7103.exe
Token: SeBackupPrivilege	1100	qwnuwcdt7103.exe
Token: SeRestorePrivilege	1100	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	1100	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	1100	qwnuwcdt7103.exe
Token: SeDebugPrivilege	2780	qwnuwcdt7103.exe
Token: SeBackupPrivilege	2780	qwnuwcdt7103.exe
Token: SeRestorePrivilege	2780	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	2780	qwnuwcdt7103.exe
Token: SeDebugPrivilege	4996	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	2780	qwnuwcdt7103.exe
Token: SeBackupPrivilege	4996	qwnuwcdt7103.exe
Token: SeRestorePrivilege	4996	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	4996	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	4996	qwnuwcdt7103.exe
Token: SeDebugPrivilege	960	qwnuwcdt7103.exe
Token: SeBackupPrivilege	960	qwnuwcdt7103.exe
Token: SeRestorePrivilege	960	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	960	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	960	qwnuwcdt7103.exe
Token: SeDebugPrivilege	3304	qwnuwcdt7103.exe
Token: SeBackupPrivilege	3304	qwnuwcdt7103.exe
Token: SeRestorePrivilege	3304	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	3304	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	3304	qwnuwcdt7103.exe
Token: SeDebugPrivilege	5096	qwnuwcdt7103.exe
Token: SeBackupPrivilege	5096	qwnuwcdt7103.exe
Token: SeRestorePrivilege	5096	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	5096	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	5096	qwnuwcdt7103.exe
Token: SeDebugPrivilege	3140	qwnuwcdt7103.exe
Token: SeBackupPrivilege	3140	qwnuwcdt7103.exe
Token: SeRestorePrivilege	3140	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	3140	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	3140	qwnuwcdt7103.exe
Token: SeDebugPrivilege	3184	qwnuwcdt7103.exe
Token: SeBackupPrivilege	3184	qwnuwcdt7103.exe
Token: SeRestorePrivilege	3184	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	3184	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	3184	qwnuwcdt7103.exe
Token: SeDebugPrivilege	4844	qwnuwcdt7103.exe
Token: SeBackupPrivilege	4844	qwnuwcdt7103.exe
Token: SeRestorePrivilege	4844	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	4844	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	4844	qwnuwcdt7103.exe
Token: SeDebugPrivilege	4072	qwnuwcdt7103.exe
Token: SeBackupPrivilege	4072	qwnuwcdt7103.exe
Token: SeRestorePrivilege	4072	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	4072	qwnuwcdt7103.exe
Token: SeCreateGlobalPrivilege	4072	qwnuwcdt7103.exe
Token: SeDebugPrivilege	2588	qwnuwcdt7103.exe
Token: SeBackupPrivilege	2588	qwnuwcdt7103.exe
Token: SeRestorePrivilege	2588	qwnuwcdt7103.exe
Token: SeLockMemoryPrivilege	2588	qwnuwcdt7103.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1560	1324	encrypt-a8.exe	83
PID 1324 wrote to memory of 1560	1324	encrypt-a8.exe	83
PID 1324 wrote to memory of 4392	1324	encrypt-a8.exe	85
PID 1324 wrote to memory of 4392	1324	encrypt-a8.exe	85
PID 1324 wrote to memory of 4392	1324	encrypt-a8.exe	85
PID 4392 wrote to memory of 3184	4392	qwnuwcdt7103.exe	86
PID 4392 wrote to memory of 3184	4392	qwnuwcdt7103.exe	86
PID 4392 wrote to memory of 3184	4392	qwnuwcdt7103.exe	86
PID 4392 wrote to memory of 1100	4392	qwnuwcdt7103.exe	87
PID 4392 wrote to memory of 1100	4392	qwnuwcdt7103.exe	87
PID 4392 wrote to memory of 1100	4392	qwnuwcdt7103.exe	87
PID 4392 wrote to memory of 2780	4392	qwnuwcdt7103.exe	88
PID 4392 wrote to memory of 2780	4392	qwnuwcdt7103.exe	88
PID 4392 wrote to memory of 2780	4392	qwnuwcdt7103.exe	88
PID 4392 wrote to memory of 4996	4392	qwnuwcdt7103.exe	89
PID 4392 wrote to memory of 4996	4392	qwnuwcdt7103.exe	89
PID 4392 wrote to memory of 4996	4392	qwnuwcdt7103.exe	89
PID 4392 wrote to memory of 4844	4392	qwnuwcdt7103.exe	90
PID 4392 wrote to memory of 4844	4392	qwnuwcdt7103.exe	90
PID 4392 wrote to memory of 4844	4392	qwnuwcdt7103.exe	90
PID 4392 wrote to memory of 3304	4392	qwnuwcdt7103.exe	91
PID 4392 wrote to memory of 3304	4392	qwnuwcdt7103.exe	91
PID 4392 wrote to memory of 3304	4392	qwnuwcdt7103.exe	91
PID 4392 wrote to memory of 3140	4392	qwnuwcdt7103.exe	92
PID 4392 wrote to memory of 3140	4392	qwnuwcdt7103.exe	92
PID 4392 wrote to memory of 3140	4392	qwnuwcdt7103.exe	92
PID 4392 wrote to memory of 5096	4392	qwnuwcdt7103.exe	93
PID 4392 wrote to memory of 5096	4392	qwnuwcdt7103.exe	93
PID 4392 wrote to memory of 5096	4392	qwnuwcdt7103.exe	93
PID 4392 wrote to memory of 960	4392	qwnuwcdt7103.exe	94
PID 4392 wrote to memory of 960	4392	qwnuwcdt7103.exe	94
PID 4392 wrote to memory of 960	4392	qwnuwcdt7103.exe	94
PID 4392 wrote to memory of 4072	4392	qwnuwcdt7103.exe	101
PID 4392 wrote to memory of 4072	4392	qwnuwcdt7103.exe	101
PID 4392 wrote to memory of 4072	4392	qwnuwcdt7103.exe	101
PID 4392 wrote to memory of 2588	4392	qwnuwcdt7103.exe	102
PID 4392 wrote to memory of 2588	4392	qwnuwcdt7103.exe	102
PID 4392 wrote to memory of 2588	4392	qwnuwcdt7103.exe	102
PID 4392 wrote to memory of 644	4392	qwnuwcdt7103.exe	208
PID 4392 wrote to memory of 644	4392	qwnuwcdt7103.exe	208
PID 4392 wrote to memory of 644	4392	qwnuwcdt7103.exe	208
PID 4392 wrote to memory of 1388	4392	qwnuwcdt7103.exe	134
PID 4392 wrote to memory of 1388	4392	qwnuwcdt7103.exe	134
PID 4392 wrote to memory of 1388	4392	qwnuwcdt7103.exe	134
PID 4392 wrote to memory of 4632	4392	qwnuwcdt7103.exe	105
PID 4392 wrote to memory of 4632	4392	qwnuwcdt7103.exe	105
PID 4392 wrote to memory of 4632	4392	qwnuwcdt7103.exe	105
PID 4392 wrote to memory of 3940	4392	qwnuwcdt7103.exe	106
PID 4392 wrote to memory of 3940	4392	qwnuwcdt7103.exe	106
PID 4392 wrote to memory of 3940	4392	qwnuwcdt7103.exe	106
PID 4392 wrote to memory of 8	4392	qwnuwcdt7103.exe	203
PID 4392 wrote to memory of 8	4392	qwnuwcdt7103.exe	203
PID 4392 wrote to memory of 8	4392	qwnuwcdt7103.exe	203
PID 4392 wrote to memory of 4772	4392	qwnuwcdt7103.exe	108
PID 4392 wrote to memory of 4772	4392	qwnuwcdt7103.exe	108
PID 4392 wrote to memory of 4772	4392	qwnuwcdt7103.exe	108
PID 4392 wrote to memory of 2404	4392	qwnuwcdt7103.exe	162
PID 4392 wrote to memory of 2404	4392	qwnuwcdt7103.exe	162
PID 4392 wrote to memory of 2404	4392	qwnuwcdt7103.exe	162
PID 4392 wrote to memory of 2604	4392	qwnuwcdt7103.exe	110
PID 4392 wrote to memory of 2604	4392	qwnuwcdt7103.exe	110
PID 4392 wrote to memory of 2604	4392	qwnuwcdt7103.exe	110
PID 4392 wrote to memory of 2304	4392	qwnuwcdt7103.exe	306
PID 4392 wrote to memory of 2304	4392	qwnuwcdt7103.exe	306

C:\Users\Admin\AppData\Local\Temp\a-8\crypto-locker-1.4.4.1-a8-Runtime\bin\encrypt-a8.exe
"C:\Users\Admin\AppData\Local\Temp\a-8\crypto-locker-1.4.4.1-a8-Runtime\bin\encrypt-a8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\a-8\crypto-locker-1.4.4.1-a8-Runtime\bin\encrypt-a8.exe C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1560
- C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
  C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1040
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:536
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    - Drops file in Program Files directory
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:116
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4540
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:456
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3800
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4380
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3344
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2312
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:436
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:116
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:228
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:456
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4540
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:228
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3316
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2748
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:228
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4380
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:376
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1172
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2652
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:380
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe
    C:\Users\Admin\AppData\Local\Temp\qwnuwcdt7103.exe -i SM-qwnuwcdt -s
    3⤵
    PID:1584

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe.locked

Filesize
1.5MB

MD5
e7faa58671577021f15ce6e5188a498c

SHA1
d855fa68f9d9c75fb0188967f19bedd39dec2540

SHA256
d26f84606f0788d3ffaea8fb44c5ec5d17c4b48678a200e2c2920a7792668bfc

SHA512
d9803b42e02f8959fb278f771a7d57cfc1bb48c1b225458fa880a112558e81c4cc6a533c86fbc35abb78023e352dc35c0a3962e37400a067d0a67a97cd3cd32e

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
de5fcf78327032ff55344803d813b884

SHA1
7c18b612f7da037e1d91dcfb2428ed17c008b5c4

SHA256
43ec57f7cb92302abb88a1c6e225de396b2ff5791b655757f9bdbfe77e2e54db

SHA512
1490192eb4873bd193eaa2047ac309473eba2b70b3c41b2847d561b7781d665553998e521b9df07e74a22795ff61be6c2f47a2eca67222b550193f054e932ca6

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
ec68d77dd0928b563c9639fdea93745b

SHA1
38757b22dc83d35ea8b4b69858e52cbbeffee22e

SHA256
01e4313d430f166abfd2f367c28ea21c993d9c3e6ac23026049f15c62590d6e6

SHA512
d1ee81cf0b7f7affa377ad60c533780d07c5c69fc53e2f802bd118feab76daaed5b8f9b068edcaf013f4897430587710eb52fe45a2cef440ec5084ce01824a8c

Download Submit
memory/1324-1-0x0000000000DC0000-0x0000000000EF5000-memory.dmp

Filesize
1.2MB

Download