05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ekstre.exe
Size 634KB
Sample240206-kcemwsddhr
SHA256 05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c
MD5 08f1f60ad0273992c1ddb62bc12dd7b5
SHA1 8c99f783c4ca334c45e74d9b38d2da88853593b8
SHA512 a742f268d5693d75db9ecb456a3b91be16db31c6552f2a72ff481288646c856dca0b9fc6268f9bc299a1f3ccbecdb6997bfb05de350b8ae40b00f11f2803892c
SSDEEP 12288:Ul1vJDJKWMN1JSqHXe6smw9qG0QY5sM9Hws8CYb7pjPDdtGzU4PW/:Ul1vbKWcrYqGgJwjr7pPhtwUt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2200	Superintellectuals.exe
4316	Superintellectuals.exe
2272	Superintellectuals.exe
1196	Superintellectuals.exe
4016	Superintellectuals.exe
760	Superintellectuals.exe
692	Superintellectuals.exe
2796	Superintellectuals.exe
4468	Superintellectuals.exe
4464	Superintellectuals.exe
1392	Superintellectuals.exe
1960	Superintellectuals.exe
2692	Superintellectuals.exe
4140	Superintellectuals.exe
4784	Superintellectuals.exe
2628	Superintellectuals.exe
3104	Superintellectuals.exe
4520	Superintellectuals.exe
1868	Superintellectuals.exe
3564	Superintellectuals.exe
3036	Superintellectuals.exe
1972	Superintellectuals.exe
3448	Superintellectuals.exe
1132	Superintellectuals.exe
416	Superintellectuals.exe
1012	Superintellectuals.exe
3772	Superintellectuals.exe
1176	Superintellectuals.exe
2000	Superintellectuals.exe
3252	Superintellectuals.exe
3144	Superintellectuals.exe
3096	Superintellectuals.exe
4384	Superintellectuals.exe
1844	Superintellectuals.exe
3484	Superintellectuals.exe
2336	Superintellectuals.exe
4392	Superintellectuals.exe
2700	Superintellectuals.exe
1448	Superintellectuals.exe
964	Superintellectuals.exe
3740	Superintellectuals.exe
2936	Superintellectuals.exe
4852	Superintellectuals.exe
4756	Superintellectuals.exe
432	Superintellectuals.exe
620	Superintellectuals.exe
436	Superintellectuals.exe
640	Superintellectuals.exe
2952	Superintellectuals.exe
3648	Superintellectuals.exe
1340	Superintellectuals.exe
2256	Superintellectuals.exe
928	Superintellectuals.exe
384	Superintellectuals.exe
628	Superintellectuals.exe
2452	Superintellectuals.exe
3276	Superintellectuals.exe
2664	Superintellectuals.exe
788	Superintellectuals.exe
2328	Superintellectuals.exe
4072	Superintellectuals.exe
4516	Superintellectuals.exe
5128	Superintellectuals.exe
5140	Superintellectuals.exe

Loads dropped DLL 1 IoCs

pid	Process
4080	ekstre.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3596	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Autoophuggernes\undaily.uns	ekstre.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

resource	yara_rule
behavioral2/files/0x000600000002315b-47.dat	nsis_installer_1
behavioral2/files/0x000600000002315b-47.dat	nsis_installer_2
behavioral2/files/0x000600000002315b-51.dat	nsis_installer_1
behavioral2/files/0x000600000002315b-51.dat	nsis_installer_2
behavioral2/files/0x000600000002315b-52.dat	nsis_installer_1
behavioral2/files/0x000600000002315b-52.dat	nsis_installer_2
behavioral2/files/0x000600000002315b-53.dat	nsis_installer_1
behavioral2/files/0x000600000002315b-53.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3596	4080	ekstre.exe	84
PID 4080 wrote to memory of 3596	4080	ekstre.exe	84
PID 4080 wrote to memory of 3596	4080	ekstre.exe	84
PID 3596 wrote to memory of 2200	3596	powershell.exe	94
PID 3596 wrote to memory of 2200	3596	powershell.exe	94
PID 3596 wrote to memory of 2200	3596	powershell.exe	94
PID 3596 wrote to memory of 4316	3596	powershell.exe	95
PID 3596 wrote to memory of 4316	3596	powershell.exe	95
PID 3596 wrote to memory of 4316	3596	powershell.exe	95
PID 3596 wrote to memory of 2272	3596	powershell.exe	96
PID 3596 wrote to memory of 2272	3596	powershell.exe	96
PID 3596 wrote to memory of 2272	3596	powershell.exe	96
PID 3596 wrote to memory of 1196	3596	powershell.exe	97
PID 3596 wrote to memory of 1196	3596	powershell.exe	97
PID 3596 wrote to memory of 1196	3596	powershell.exe	97
PID 3596 wrote to memory of 4016	3596	powershell.exe	98
PID 3596 wrote to memory of 4016	3596	powershell.exe	98
PID 3596 wrote to memory of 4016	3596	powershell.exe	98
PID 3596 wrote to memory of 760	3596	powershell.exe	99
PID 3596 wrote to memory of 760	3596	powershell.exe	99
PID 3596 wrote to memory of 760	3596	powershell.exe	99
PID 3596 wrote to memory of 692	3596	powershell.exe	100
PID 3596 wrote to memory of 692	3596	powershell.exe	100
PID 3596 wrote to memory of 692	3596	powershell.exe	100
PID 3596 wrote to memory of 2796	3596	powershell.exe	101
PID 3596 wrote to memory of 2796	3596	powershell.exe	101
PID 3596 wrote to memory of 2796	3596	powershell.exe	101
PID 3596 wrote to memory of 4468	3596	powershell.exe	102
PID 3596 wrote to memory of 4468	3596	powershell.exe	102
PID 3596 wrote to memory of 4468	3596	powershell.exe	102
PID 3596 wrote to memory of 4464	3596	powershell.exe	103
PID 3596 wrote to memory of 4464	3596	powershell.exe	103
PID 3596 wrote to memory of 4464	3596	powershell.exe	103
PID 3596 wrote to memory of 1392	3596	powershell.exe	104
PID 3596 wrote to memory of 1392	3596	powershell.exe	104
PID 3596 wrote to memory of 1392	3596	powershell.exe	104
PID 3596 wrote to memory of 1836	3596	powershell.exe	105
PID 3596 wrote to memory of 1836	3596	powershell.exe	105
PID 3596 wrote to memory of 1836	3596	powershell.exe	105
PID 3596 wrote to memory of 3976	3596	powershell.exe	106
PID 3596 wrote to memory of 3976	3596	powershell.exe	106
PID 3596 wrote to memory of 3976	3596	powershell.exe	106
PID 3596 wrote to memory of 1116	3596	powershell.exe	107
PID 3596 wrote to memory of 1116	3596	powershell.exe	107
PID 3596 wrote to memory of 1116	3596	powershell.exe	107
PID 3596 wrote to memory of 3332	3596	powershell.exe	108
PID 3596 wrote to memory of 3332	3596	powershell.exe	108
PID 3596 wrote to memory of 3332	3596	powershell.exe	108
PID 3596 wrote to memory of 2160	3596	powershell.exe	109
PID 3596 wrote to memory of 2160	3596	powershell.exe	109
PID 3596 wrote to memory of 2160	3596	powershell.exe	109
PID 3596 wrote to memory of 3672	3596	powershell.exe	110
PID 3596 wrote to memory of 3672	3596	powershell.exe	110
PID 3596 wrote to memory of 3672	3596	powershell.exe	110
PID 3596 wrote to memory of 4108	3596	powershell.exe	111
PID 3596 wrote to memory of 4108	3596	powershell.exe	111
PID 3596 wrote to memory of 4108	3596	powershell.exe	111
PID 3596 wrote to memory of 3788	3596	powershell.exe	112
PID 3596 wrote to memory of 3788	3596	powershell.exe	112
PID 3596 wrote to memory of 3788	3596	powershell.exe	112
PID 3596 wrote to memory of 836	3596	powershell.exe	113
PID 3596 wrote to memory of 836	3596	powershell.exe	113
PID 3596 wrote to memory of 836	3596	powershell.exe	113
PID 3596 wrote to memory of 4724	3596	powershell.exe	114

C:\Users\Admin\AppData\Local\Temp\ekstre.exe
"C:\Users\Admin\AppData\Local\Temp\ekstre.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Undertones=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Theologization239\detektors\atlantosaurus\Lovliggrelser\Sektionerer\Cupidon\Kobolt.Gla';$Barsellov=$Undertones.SubString(42698,3);.$Barsellov($Undertones)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:692
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1392
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1836
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3976
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1116
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3332
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2160
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3672
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4108
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3788
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:836
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4724
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2680
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:404
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2768
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2940
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:212
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1420
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4736
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3580
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3816
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3128
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3036
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4500
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4548
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4508
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4480
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4832
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2696
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2120
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1096
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4144
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4636
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4184
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1856
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3348
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3548
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2908
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:756
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3780
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3140
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4800
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3480
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:416
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1012
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3144
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2040
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2784
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1056
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:948
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3808
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4908
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3208
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1356
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4352
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5040
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4808
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4968
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2044
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4668
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2140
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2320
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1208
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3920
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1036
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4796
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3328
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3740
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4092
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:724
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1592
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4564
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1688
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5064
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4712
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1876
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3288
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1656
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:736
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2596
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3524
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:636
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5036
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3304
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3172
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3156
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4656
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4340
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:436
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:1340
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2684
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1244
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1840
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3488
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2008
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1984
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3420
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3504
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1596
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3352
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4848
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2380
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3064
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3120
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4148
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4312
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2456
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:748
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1736
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4704
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:384
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:2328
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4072
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1212
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:1604
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2460
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2384
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3508
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4152
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4472
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:3152
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4408
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3644
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1692
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4828
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2116
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2428
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5012
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:920
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4084
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4288
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2712
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    - Executes dropped EXE
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5224
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5236
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5244
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5252
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5260
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5268
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5276
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5284
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5292
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5300
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5308
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5316
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5324
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5332
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5340
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5348
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5356
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5364
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5372
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5384
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5392
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5524
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5536
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5544
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5552
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5560
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5568
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5580
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5588
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5596
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5604
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5612
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5620
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5628
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5636
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5644
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5652
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5660
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5668
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5676
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5684
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5692
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:5820
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5832
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5840
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5848
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5856
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5864
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5872
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5880
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5888
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5896
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5904
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5912
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5920
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5928
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5936
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5944
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5952
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5960
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5968
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5976
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5984
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6108
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6120
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6128
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6136
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5136
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5160
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5184
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5208
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5232
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5416
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:5440
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5472
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5496
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5520
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5380
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5728
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5752
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5780
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5804
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5828
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3860
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6200
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6212
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6220
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6228
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6236
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6244
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6252
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6260
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6268
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6276
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6284
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6292
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6304
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6312
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6320
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6328
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6336
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6344
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6352
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6360
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6368
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6456
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6492
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6504
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6512
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6520
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6528
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6536
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6544
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6552
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6560
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6568
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6576
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6584
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6592
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6600
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6608
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6616
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6624
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6632
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6640
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6648
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6660
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6784
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6796
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6804
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6812
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6820
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6828
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6836
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6844
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6852
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6860
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6868
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6876
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6884
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6892
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6900
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6908
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6916
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6924
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6932
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6940
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6948
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7000
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7024
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7076
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7088
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7096
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7104
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7112
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7120
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7128
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7136
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7144
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7152
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7160
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6148
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6172
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6196
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:5124
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6404
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6428
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6452
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6476
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6500
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:3540
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:840
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6708
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6780
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:6972
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7048
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7172
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7180
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7188
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7196
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7204
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7212
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7220
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7228
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7236
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7244
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7252
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7260
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7268
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7276
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7284
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7292
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7308
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7332
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7344
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7368
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7380
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7404
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7416
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7428
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7436
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7444
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7452
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7460
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7468
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7476
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7484
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7492
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7500
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7508
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7516
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7528
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7536
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7544
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7552
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7560
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7568
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7576
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7584
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7600
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7636
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7648
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7696
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7708
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7720
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7736
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7744
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7760
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7772
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7780
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7788
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7796
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7804
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7812
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7820
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7828
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7836
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7844
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7852
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7860
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7868
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7876
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7884
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7892
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7912
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7924
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7936
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7948
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7972
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7996
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8008
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8020
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8032
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8040
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8048
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8056
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8064
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8072
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8080
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8088
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8096
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8104
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8112
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8120
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8128
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8136
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8144
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8152
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8160
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8168
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8176
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8184
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7352
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7388
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7644
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:7716
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7752
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7728
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7524
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7932
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7956
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7968
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7992
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8016
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:2612
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7340
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7412
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:1404
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7620
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:7704
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2576
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8200
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8208
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8216
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8224
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8232
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8240
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8248
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8260
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8272
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8296
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8308
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8320
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8344
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8356
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8368
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8376
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8384
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8392
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8400
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8412
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8420
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8428
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8436
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8444
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8452
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8460
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8468
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8476
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8484
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8492
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8500
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8508
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8516
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8524
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8532
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8540
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8564
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8576
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8588
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8624
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8636
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8648
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8660
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8668
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8676
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8684
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8692
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8700
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8708
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8716
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8724
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8732
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8740
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8748
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8756
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8768
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8776
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8784
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8792
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8800
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8808
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8816
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8832
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8844
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8856
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8868
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8880
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8892
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8904
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8916
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8928
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8940
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8952
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8960
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8968
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8976
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8984
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8992
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9000
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9008
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9016
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9024
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9032
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9040
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9048
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9056
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9064
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9072
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9080
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9088
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9096
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9104
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9120
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9148
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9160
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9172
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9184
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9196
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9208
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8268
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:8304
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7632
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8352
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8548
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8572
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8596
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8620
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8644
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8408
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8852
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:8876
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8900
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8924
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8948
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9128
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9156
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9180
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9204
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:8292
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9220
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9228
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9236
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9244
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9256
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9280
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9292
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9304
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9316
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9328
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9340
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9356
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9368
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9376
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9384
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9392
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9400
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9408
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9416
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9424
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9432
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9440
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9448
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9456
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9464
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9472
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9480
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9488
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9496
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9504
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9512
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9520
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9536
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9548
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9560
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9572
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9584
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9596
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9620
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9632
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9644
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9656
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9664
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9672
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9680
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9688
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9696
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9704
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9716
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9724
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9732
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9740
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9748
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9756
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9764
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9772
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9780
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9788
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9796
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9804
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9812
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9820
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9828
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9840
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9852
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9864
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9876
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9888
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9900
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9924
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:9936
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9948
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9956
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9964
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9972
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9980
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9988
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9996
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10004
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10012
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10020
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10028
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10036
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10044
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10052
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10064
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10072
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10080
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10088
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10096
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10104
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10112
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10120
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10132
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10144
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10156
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10168
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10180
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10192
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10204
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10216
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10228
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9132
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9264
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9288
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9312
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:4496
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9324
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9348
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9544
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9568
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9592
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9616
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9352
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9652
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9848
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9872
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9896
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9920
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:9944
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10128
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10152
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10176
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10200
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10236
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10280
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10316
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10328
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10340
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10348
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10356
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10364
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10372
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10380
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10388
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10396
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10404
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10412
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10420
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10428
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10436
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10444
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10452
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10460
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10468
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10476
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10484
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10492
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10500
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10508
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10520
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10532
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10544
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10556
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10568
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10592
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10604
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10616
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10628
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10640
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10648
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10656
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10664
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10672
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10680
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10688
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10700
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10708
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10716
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10724
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10732
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10740
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10748
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10756
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10764
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10772
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10780
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10788
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10804
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10816
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10840
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10852
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10864
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10876
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10888
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10900
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10912
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10924
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10932
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10940
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10948
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10956
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10964
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10972
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10980
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10992
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11004
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11012
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11020
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11028
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11036
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11044
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11052
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11060
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11068
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11076
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11084
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11092
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11112
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11124
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11136
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11148
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11160
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11172
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11196
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11208
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11220
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11228
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11236
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11244
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11252
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11260
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10264
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10288
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10312
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:10336
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10224
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10540
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10552
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10576
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10600
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10624
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:2244
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10812
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10848
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10872
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:10896
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:10920
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11120
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11156
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11192
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11000
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11180
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11144
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11276
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11300
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11312
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11320
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11328
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11336
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11344
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11352
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11360
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11368
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11376
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11384
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11392
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11400
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11408
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11416
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11424
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11432
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11440
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11448
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11456
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11464
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11472
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11480
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11492
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11504
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11516
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11528
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11544
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11556
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11568
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11580
- - C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
    "C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe"
    3⤵
    PID:11592
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11604
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11612
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11620
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11628
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11636
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11644
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11652
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11660
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11668
- - C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:11676
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11684
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11692
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11700
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11708
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11716
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11724
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11732
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11740
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    PID:11748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Superintellectuals.exe

Path C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
Size 634KB
SHA256 05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c
MD5 08f1f60ad0273992c1ddb62bc12dd7b5
SHA1 8c99f783c4ca334c45e74d9b38d2da88853593b8
SHA512 a742f268d5693d75db9ecb456a3b91be16db31c6552f2a72ff481288646c856dca0b9fc6268f9bc299a1f3ccbecdb6997bfb05de350b8ae40b00f11f2803892c
SSDEEP 12288:Ul1vJDJKWMN1JSqHXe6smw9qG0QY5sM9Hws8CYb7pjPDdtGzU4PW/:Ul1vbKWcrYqGgJwjr7pPhtwUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Superintellectuals.exe

Path C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
Size 256KB
SHA256 75d0a8f41bed8031f1d47fc890f2d3d66f18e0237c640c33e1c839a8fa6a582c
MD5 62195b5da18cad4658b9446a715ee386
SHA1 ee4f7e9670f9cb906d016d41fcdbca5d357d12aa
SHA512 3d4e6b26834ee85afa5a46e58102e3760729d1945e538567c514703fb399aaff45cf0b30f83fe12507cac3f8bae6bfead581b81f636d9736d9caf533b6d83945
SSDEEP 6144:IBe6l12mAjx6JD3eWfJkBYECAfagTJPR5kJUHmyHS:Ul1vJDJKWMN1JSqHXS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Superintellectuals.exe

Path C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
Size 192KB
SHA256 fde6bcd16763b8f0f8105bcf6326f388cd4e6f7bb120e036238daa020f60e311
MD5 3b8fee61fd7d33bf2e7cabc05d40e957
SHA1 b3c4d2b7eb70187d9ee16726108b36678b8726ff
SHA512 9874de99b862ff274883b31b80d5ed6f68b78e77356963eeee9df29aa59ac323e999bc94743a0b3a3c3ddc5e9fc7c28e9b470f9a39f8c7ff27eaf458b42727f2
SSDEEP 3072:IQZvOsPPKedcs0l1222mmmmf3s7mcAjx69+VgDSmmy1eWGFYOwNyAoLYE0+ubAfN:IBe6l12mAjx6JD3eWfJkBYECAfagTJPN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Superintellectuals.exe

Path C:\Users\Admin\AppData\Local\Temp\Superintellectuals.exe
Size 214KB
SHA256 d4de353b203c89aa73c8b39cbb07c248209c221e5af4771cc15a231f8b19eca8
MD5 a62c5662892ffe3ee9271569ca402c87
SHA1 0fca784acecf885f58a058655f817098fce649f2
SHA512 44c205c923311bee51f8098774d0148c403244508d6d2a9b5a365fda3e582e8cc418a48a03418704df944f77a5356260ca7819c01c541d33b4e10f692821a365
SSDEEP 6144:IBe6l12mAjx6JD3eWfJkBYECAfagTJPR5kJQ:Ul1vJDJKWMN1JSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Holdouts90.Mis

Path C:\Users\Admin\AppData\Local\Temp\Theologization239\detektors\atlantosaurus\Holdouts90.Mis
Size 339KB
SHA256 469e600ecc6c693c22125f2d33f7807c74ffd66e404c1d2890a97a9880193740
MD5 03005784a48b3b8a1dd7c4673463d75e
SHA1 30af2509d4864a4eb1d38d5a7eb25680cb01007a
SHA512 08078f53235938e49eca23c647e3b67ef1a6a55c7f0fe2a4e506cbdfb5f4ff8a5d209ff4320801bd67bd10f15be661b9d52ac85b8dd0aaba34151310f85327e4
SSDEEP 6144:HMWsxbmVaQDuTNcrbJ3XtfeWyq0oOWbWzFGDo:s2FoUJ3XQ1+OrG8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kobolt.Gla

Path C:\Users\Admin\AppData\Local\Temp\Theologization239\detektors\atlantosaurus\Lovliggrelser\Sektionerer\Cupidon\Kobolt.Gla
Size 41KB
SHA256 463f10b6c36b2c8e54869ec73781820df1410bbf32814cf5d9d3c655ed46d4d7
MD5 aa814b7952d3d08a26a5c0b02cee75d4
SHA1 568a9c283acac3f47846ea0ef9aefe064e65c1b6
SHA512 8b2983bf27cc7803b2f7628894ee06306d895f797fbffdd757a2bf6b93dc6035de3d32b99884a8ebb9289a15ef08bcf328b84764153f6a8855e812a849f72a62
SSDEEP 768:DuzPRnjUEtM3R/8ak+1Azi6f/uXSJkTHN7PELrx2Y1ODnQi6ZB2nnCjMiptXH5:eRUEtERDk+WVrJiHpPiraDAsCAwH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_unuaugwl.0ql.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_unuaugwl.0ql.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyCF47.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3596-31-0x00000000068C0000-0x00000000068DA000-memory.dmp

Download

memory/3596-37-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

Download

memory/3596-27-0x00000000063B0000-0x00000000063CE000-memory.dmp

Download

memory/3596-28-0x0000000006440000-0x000000000648C000-memory.dmp

Download

memory/3596-29-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

Download

memory/3596-30-0x0000000006910000-0x00000000069A6000-memory.dmp

Download

memory/3596-21-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/3596-32-0x0000000007570000-0x0000000007592000-memory.dmp

Download

memory/3596-33-0x0000000007BF0000-0x0000000008194000-memory.dmp

Download

memory/3596-15-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Download

memory/3596-35-0x0000000008820000-0x0000000008E9A000-memory.dmp

Download

memory/3596-22-0x0000000005DE0000-0x0000000006134000-memory.dmp

Download

memory/3596-14-0x00000000054C0000-0x00000000054E2000-memory.dmp

Download

memory/3596-39-0x0000000007930000-0x0000000007934000-memory.dmp

Download

memory/3596-40-0x00000000736B0000-0x0000000073E60000-memory.dmp

Download

memory/3596-42-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

Download

memory/3596-43-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

Download

memory/3596-44-0x0000000008EA0000-0x000000000DB01000-memory.dmp

Download

memory/3596-45-0x0000000077101000-0x0000000077221000-memory.dmp

Download

memory/3596-13-0x00000000054F0000-0x0000000005B18000-memory.dmp

Download

memory/3596-12-0x0000000002D90000-0x0000000002DC6000-memory.dmp

Download

memory/3596-11-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

Download

memory/3596-10-0x00000000736B0000-0x0000000073E60000-memory.dmp

Download