f1ef3f240b9c67b8f28cd0143ed999d1e7fed7658185508fcf8b8fcd52878db7

Analysis

max time kernel
86s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

checker/start.bat
Size

821B
MD5

939326ae06d8780519e75681e0b53980
SHA1

3a9c2cc7ee9c19f601228faef11488fab93ab09f
SHA256

6975a31f8e6872be564de99fd2a9a11098c596a947db32ecf91a45e742796266
SHA512

0baeb62d6ed88265f49068e0050447b723b8c0c85ca2d67b4d98e5c28852a3f49f226584465abbfde9bde837261745934ada88223ba4d114cef078535d28b56b

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
2056	taskkill.exe
320	taskkill.exe
3520	taskkill.exe
2456	taskkill.exe
4284	taskkill.exe
1336	taskkill.exe
5612	taskkill.exe
716	taskkill.exe
1464	taskkill.exe
3564	taskkill.exe
1408	taskkill.exe
1272	taskkill.exe
5620	taskkill.exe
5360	taskkill.exe
4304	taskkill.exe
3220	taskkill.exe
4200	taskkill.exe
2460	taskkill.exe
2284	taskkill.exe
3760	taskkill.exe
2152	taskkill.exe
5728	taskkill.exe
2056	taskkill.exe
4316	taskkill.exe
5672	taskkill.exe
5212	taskkill.exe
5876	taskkill.exe
3644	taskkill.exe
3852	taskkill.exe
6088	taskkill.exe
4036	taskkill.exe
5372	taskkill.exe
2848	taskkill.exe
5096	taskkill.exe
5452	taskkill.exe
4644	taskkill.exe
548	taskkill.exe
2260	taskkill.exe
4028	taskkill.exe
5008	taskkill.exe
3992	taskkill.exe
4404	taskkill.exe
4652	taskkill.exe
5028	taskkill.exe
5236	taskkill.exe
1960	taskkill.exe
3396	taskkill.exe
5260	taskkill.exe
2208	taskkill.exe
2168	taskkill.exe
3272	taskkill.exe
2424	taskkill.exe
5608	taskkill.exe
1100	taskkill.exe
5804	taskkill.exe
2168	taskkill.exe
2608	taskkill.exe
5056	taskkill.exe
1028	taskkill.exe
1672	taskkill.exe
3504	taskkill.exe
5428	taskkill.exe
2368	taskkill.exe
5160	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
5744	msedge.exe
5744	msedge.exe
5408	msedge.exe
5408	msedge.exe
3224	msedge.exe
3224	msedge.exe
5808	msedge.exe
5808	msedge.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
2104	taskmgr.exe
2104	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
5408	msedge.exe
5408	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	taskkill.exe
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeDebugPrivilege	3592	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	456	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	4448	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	4760	taskkill.exe
Token: SeDebugPrivilege	2456	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	3220	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 3868	3108	cmd.exe	87
PID 3108 wrote to memory of 3868	3108	cmd.exe	87
PID 3868 wrote to memory of 320	3868	cmd.exe	89
PID 3868 wrote to memory of 320	3868	cmd.exe	89
PID 3868 wrote to memory of 2868	3868	cmd.exe	91
PID 3868 wrote to memory of 2868	3868	cmd.exe	91
PID 3868 wrote to memory of 3592	3868	cmd.exe	92
PID 3868 wrote to memory of 3592	3868	cmd.exe	92
PID 3868 wrote to memory of 2908	3868	cmd.exe	93
PID 3868 wrote to memory of 2908	3868	cmd.exe	93
PID 3868 wrote to memory of 632	3868	cmd.exe	94
PID 3868 wrote to memory of 632	3868	cmd.exe	94
PID 3868 wrote to memory of 1648	3868	cmd.exe	95
PID 3868 wrote to memory of 1648	3868	cmd.exe	95
PID 3868 wrote to memory of 3644	3868	cmd.exe	96
PID 3868 wrote to memory of 3644	3868	cmd.exe	96
PID 3868 wrote to memory of 1068	3868	cmd.exe	97
PID 3868 wrote to memory of 1068	3868	cmd.exe	97
PID 1068 wrote to memory of 2260	1068	cmd.exe	99
PID 1068 wrote to memory of 2260	1068	cmd.exe	99
PID 1068 wrote to memory of 4980	1068	cmd.exe	100
PID 1068 wrote to memory of 4980	1068	cmd.exe	100
PID 1068 wrote to memory of 4304	1068	cmd.exe	102
PID 1068 wrote to memory of 4304	1068	cmd.exe	102
PID 1068 wrote to memory of 1072	1068	cmd.exe	104
PID 1068 wrote to memory of 1072	1068	cmd.exe	104
PID 1068 wrote to memory of 4664	1068	cmd.exe	105
PID 1068 wrote to memory of 4664	1068	cmd.exe	105
PID 1068 wrote to memory of 2444	1068	cmd.exe	106
PID 1068 wrote to memory of 2444	1068	cmd.exe	106
PID 1068 wrote to memory of 224	1068	cmd.exe	108
PID 1068 wrote to memory of 224	1068	cmd.exe	108
PID 1068 wrote to memory of 3480	1068	cmd.exe	109
PID 1068 wrote to memory of 3480	1068	cmd.exe	109
PID 3480 wrote to memory of 1788	3480	cmd.exe	111
PID 3480 wrote to memory of 1788	3480	cmd.exe	111
PID 3480 wrote to memory of 4100	3480	cmd.exe	112
PID 3480 wrote to memory of 4100	3480	cmd.exe	112
PID 3480 wrote to memory of 1568	3480	cmd.exe	113
PID 3480 wrote to memory of 1568	3480	cmd.exe	113
PID 3480 wrote to memory of 3928	3480	cmd.exe	114
PID 3480 wrote to memory of 3928	3480	cmd.exe	114
PID 3480 wrote to memory of 1272	3480	cmd.exe	115
PID 3480 wrote to memory of 1272	3480	cmd.exe	115
PID 3480 wrote to memory of 1524	3480	cmd.exe	116
PID 3480 wrote to memory of 1524	3480	cmd.exe	116
PID 3480 wrote to memory of 3800	3480	cmd.exe	117
PID 3480 wrote to memory of 3800	3480	cmd.exe	117
PID 3480 wrote to memory of 4272	3480	cmd.exe	118
PID 3480 wrote to memory of 4272	3480	cmd.exe	118
PID 4272 wrote to memory of 5056	4272	cmd.exe	120
PID 4272 wrote to memory of 5056	4272	cmd.exe	120
PID 4272 wrote to memory of 5036	4272	cmd.exe	121
PID 4272 wrote to memory of 5036	4272	cmd.exe	121
PID 4272 wrote to memory of 3588	4272	cmd.exe	122
PID 4272 wrote to memory of 3588	4272	cmd.exe	122
PID 4272 wrote to memory of 2116	4272	cmd.exe	123
PID 4272 wrote to memory of 2116	4272	cmd.exe	123
PID 4272 wrote to memory of 4036	4272	cmd.exe	124
PID 4272 wrote to memory of 4036	4272	cmd.exe	124
PID 4272 wrote to memory of 2056	4272	cmd.exe	125
PID 4272 wrote to memory of 2056	4272	cmd.exe	125
PID 4272 wrote to memory of 2324	4272	cmd.exe	126
PID 4272 wrote to memory of 2324	4272	cmd.exe	126

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\checker\start.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DiscordCanary.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DiscordPTB.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DiscordAlpha.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SnippingTool.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Discord.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DiscordCanary.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DiscordPTB.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im DiscordAlpha.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SnippingTool.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:224
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        6⤵
        
        PID:4228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        7⤵
        
        PID:2012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        8⤵
        
        PID:2844
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        9⤵
        
        PID:2880
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        10⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        10⤵
        
        PID:1680
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        11⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        11⤵
        
        PID:3404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        12⤵
        
        PID:4980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        12⤵
        
        PID:2848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        12⤵
        
        PID:4368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        12⤵
        
        PID:1344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        12⤵
        
        PID:4792
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        12⤵
        
        PID:3604
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        12⤵
        
        PID:5000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        13⤵
        
        PID:4608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        13⤵
        
        PID:5076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        13⤵
        
        PID:1820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        13⤵
        
        PID:4896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        13⤵
        
        PID:3940
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        13⤵
        
        PID:3796
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        13⤵
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        13⤵
        
        PID:4500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        14⤵
        
        PID:1140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        14⤵
        
        PID:4340
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        14⤵
        Kills process with taskkill
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        14⤵
        
        PID:2528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        14⤵
        
        PID:4004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        14⤵
        
        PID:2368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        14⤵
        
        PID:4644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        14⤵
        
        PID:1864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        15⤵
        
        PID:5108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        15⤵
        
        PID:636
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        15⤵
        
        PID:3128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        15⤵
        
        PID:1712
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        15⤵
        
        PID:2008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        15⤵
        
        PID:532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        15⤵
        
        PID:4592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        15⤵
        
        PID:1332
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        16⤵
        
        PID:3604
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        16⤵
        
        PID:3832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        16⤵
        
        PID:1788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        16⤵
        
        PID:1056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        16⤵
        
        PID:1820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        16⤵
        
        PID:1700
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        16⤵
        
        PID:4384
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        16⤵
        
        PID:5024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        17⤵
        
        PID:2436
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        17⤵
        
        PID:4036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        17⤵
        
        PID:468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        17⤵
        
        PID:4584
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        17⤵
        
        PID:2392
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        17⤵
        
        PID:972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        17⤵
        
        PID:1336
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        17⤵
        
        PID:3060
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        18⤵
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        18⤵
        
        PID:1112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        18⤵
        
        PID:2868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        18⤵
        
        PID:1980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        18⤵
        
        PID:4168
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        18⤵
        
        PID:5032
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        18⤵
        
        PID:4548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        18⤵
        
        PID:1472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        18⤵
        
        PID:4152
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:4980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        19⤵
        
        PID:2848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        19⤵
        
        PID:4368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        19⤵
        Kills process with taskkill
        
        PID:4652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        19⤵
        
        PID:4228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        19⤵
        
        PID:2736
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        19⤵
        Kills process with taskkill
        
        PID:4200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        19⤵
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        19⤵
        
        PID:3972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        20⤵
        
        PID:2056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        20⤵
        
        PID:408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        20⤵
        Kills process with taskkill
        
        PID:1960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        20⤵
        
        PID:1140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        20⤵
        
        PID:4820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        20⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        20⤵
        
        PID:5024
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        20⤵
        
        PID:2808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        21⤵
        
        PID:3220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        21⤵
        
        PID:4208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        21⤵
        
        PID:3644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        21⤵
        
        PID:3248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        21⤵
        
        PID:4044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        21⤵
        
        PID:2900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        21⤵
        
        PID:1680
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        21⤵
        
        PID:3564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        22⤵
        
        PID:344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        22⤵
        Kills process with taskkill
        
        PID:4316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        22⤵
        
        PID:2216
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        22⤵
        
        PID:532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        22⤵
        
        PID:3516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        22⤵
        
        PID:4148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        22⤵
        
        PID:3584
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        22⤵
        
        PID:4980
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:4036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        23⤵
        
        PID:5008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        23⤵
        
        PID:3096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        23⤵
        
        PID:972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        23⤵
        Kills process with taskkill
        
        PID:1336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        23⤵
        
        PID:4160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        23⤵
        
        PID:2276
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        23⤵
        
        PID:2368
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        23⤵
        
        PID:2000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        24⤵
        
        PID:4168
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        24⤵
        
        PID:2352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        24⤵
        
        PID:3628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        24⤵
        
        PID:1296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        24⤵
        Kills process with taskkill
        
        PID:4028
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        24⤵
        
        PID:5108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        24⤵
        
        PID:4644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        24⤵
        
        PID:4532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        25⤵
        
        PID:2444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        25⤵
        
        PID:3392
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        25⤵
        Kills process with taskkill
        
        PID:3396
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        25⤵
        
        PID:4592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        25⤵
        
        PID:4200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        25⤵
        
        PID:3284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        25⤵
        Kills process with taskkill
        
        PID:2424
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        25⤵
        
        PID:1472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        26⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        26⤵
        
        PID:2672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        26⤵
        
        PID:3560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        26⤵
        
        PID:2320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        26⤵
        Kills process with taskkill
        
        PID:2460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        26⤵
        
        PID:4100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        26⤵
        
        PID:1508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        26⤵
        
        PID:3668
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        27⤵
        
        PID:3972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        27⤵
        
        PID:4980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        27⤵
        
        PID:4208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        27⤵
        
        PID:3644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        27⤵
        
        PID:3248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        27⤵
        
        PID:1592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        27⤵
        
        PID:4272
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        27⤵
        
        PID:1996
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        28⤵
        
        PID:2868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        28⤵
        
        PID:1632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        28⤵
        
        PID:4316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        28⤵
        
        PID:4592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        28⤵
        
        PID:1560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        28⤵
        
        PID:2700
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        28⤵
        
        PID:2672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        28⤵
        
        PID:1336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        29⤵
        Kills process with taskkill
        
        PID:4036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        29⤵
        
        PID:2916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        29⤵
        
        PID:4816
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        29⤵
        Kills process with taskkill
        
        PID:1028
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        29⤵
        
        PID:4732
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        29⤵
        
        PID:5144
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        29⤵
        
        PID:5176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        29⤵
        
        PID:5204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        30⤵
        
        PID:5252
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        30⤵
        
        PID:5280
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        30⤵
        
        PID:5308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        30⤵
        
        PID:5336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        30⤵
        
        PID:5364
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        30⤵
        
        PID:5396
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        30⤵
        
        PID:5492
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        30⤵
        
        PID:5596
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        31⤵
        
        PID:5092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        31⤵
        
        PID:4072
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        31⤵
        
        PID:1468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        31⤵
        
        PID:4432
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        31⤵
        
        PID:3644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        31⤵
        
        PID:1592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        31⤵
        Kills process with taskkill
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        31⤵
        
        PID:972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        32⤵
        
        PID:4500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        32⤵
        
        PID:3516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        32⤵
        
        PID:2220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        32⤵
        
        PID:5008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        32⤵
        
        PID:2484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        32⤵
        
        PID:1836
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        32⤵
        
        PID:5220
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        32⤵
        
        PID:5260
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        33⤵
        
        PID:5320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        33⤵
        
        PID:5344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        33⤵
        Kills process with taskkill
        
        PID:5372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        33⤵
        
        PID:5488
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        33⤵
        Kills process with taskkill
        
        PID:1272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        33⤵
        
        PID:5512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        33⤵
        
        PID:5208
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        33⤵
        
        PID:5212
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        34⤵
        
        PID:6036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        34⤵
        
        PID:5108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        34⤵
        
        PID:592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        34⤵
        Kills process with taskkill
        
        PID:2848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        34⤵
        
        PID:2284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        34⤵
        
        PID:5624
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        34⤵
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        34⤵
        
        PID:3516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        35⤵
        
        PID:5408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        35⤵
        Kills process with taskkill
        
        PID:5008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        35⤵
        
        PID:2672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        35⤵
        
        PID:1140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        35⤵
        
        PID:5180
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        35⤵
        
        PID:5188
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        35⤵
        
        PID:5192
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        35⤵
        
        PID:3400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        36⤵
        
        PID:5272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        36⤵
        
        PID:1064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        36⤵
        
        PID:1680
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        36⤵
        
        PID:5308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        36⤵
        
        PID:5356
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        36⤵
        
        PID:5392
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        36⤵
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        36⤵
        
        PID:5524
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:1272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        37⤵
        
        PID:5204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        37⤵
        
        PID:5252
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        37⤵
        
        PID:5296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        37⤵
        Kills process with taskkill
        
        PID:5096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        37⤵
        
        PID:5028
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        37⤵
        
        PID:3520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        37⤵
        
        PID:1704
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        37⤵
        
        PID:4308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        38⤵
        
        PID:1820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        38⤵
        
        PID:5888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        38⤵
        
        PID:4768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        38⤵
        
        PID:6056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        38⤵
        Kills process with taskkill
        
        PID:5612
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        38⤵
        
        PID:6120
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        38⤵
        
        PID:5636
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        38⤵
        
        PID:5648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        39⤵
        
        PID:5760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        39⤵
        
        PID:4036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        39⤵
        
        PID:3100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        39⤵
        
        PID:4824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        39⤵
        
        PID:5516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        39⤵
        Kills process with taskkill
        
        PID:5452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        39⤵
        
        PID:5592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        39⤵
        
        PID:5572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        40⤵
        
        PID:6044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        40⤵
        Kills process with taskkill
        
        PID:5620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        40⤵
        
        PID:6084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        40⤵
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        40⤵
        
        PID:3708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        40⤵
        
        PID:5868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        40⤵
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        40⤵
        
        PID:5720
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        41⤵
        
        PID:5408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        41⤵
        
        PID:5008
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        41⤵
        
        PID:3068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        41⤵
        Kills process with taskkill
        
        PID:5160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        41⤵
        
        PID:3192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        41⤵
        Kills process with taskkill
        
        PID:1672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        41⤵
        Kills process with taskkill
        
        PID:3504
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        41⤵
        
        PID:344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        42⤵
        
        PID:968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        42⤵
        
        PID:5352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        42⤵
        
        PID:5376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        42⤵
        
        PID:5364
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        42⤵
        
        PID:5436
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        42⤵
        
        PID:5532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        42⤵
        
        PID:3228
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        42⤵
        
        PID:1508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        43⤵
        
        PID:5316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        43⤵
        
        PID:5288
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        43⤵
        
        PID:6140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        43⤵
        
        PID:6116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        43⤵
        
        PID:6016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        43⤵
        
        PID:5092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        43⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        43⤵
        
        PID:408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        44⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        44⤵
        
        PID:4540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        44⤵
        
        PID:2284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        44⤵
        Kills process with taskkill
        
        PID:3644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        44⤵
        
        PID:5728
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        44⤵
        
        PID:5768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        44⤵
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        44⤵
        
        PID:5520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        45⤵
        
        PID:5748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        45⤵
        
        PID:1688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        45⤵
        
        PID:3732
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        45⤵
        
        PID:5704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        45⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        45⤵
        
        PID:532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        45⤵
        
        PID:3564
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        45⤵
        
        PID:5812
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        46⤵
        
        PID:5776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        46⤵
        
        PID:5932
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        46⤵
        
        PID:5972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        46⤵
        
        PID:6076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        46⤵
        
        PID:6104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        46⤵
        
        PID:5948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        46⤵
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        46⤵
        
        PID:3708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        47⤵
        Kills process with taskkill
        
        PID:5608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        47⤵
        
        PID:1540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        47⤵
        
        PID:1764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        47⤵
        
        PID:2672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        47⤵
        
        PID:4148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        47⤵
        
        PID:6072
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        47⤵
        
        PID:2856
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        47⤵
        
        PID:2352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        48⤵
        
        PID:5200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        48⤵
        Kills process with taskkill
        
        PID:3992
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        48⤵
        Kills process with taskkill
        
        PID:1100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        48⤵
        
        PID:3560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        48⤵
        
        PID:5276
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        48⤵
        
        PID:5396
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        48⤵
        
        PID:4224
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        48⤵
        
        PID:5060
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        49⤵
        
        PID:5512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        49⤵
        
        PID:2368
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        49⤵
        
        PID:1876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        49⤵
        
        PID:5984
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        49⤵
        
        PID:5968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        49⤵
        
        PID:5204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        49⤵
        
        PID:5224
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        49⤵
        
        PID:5740
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        50⤵
        
        PID:4540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        50⤵
        
        PID:5640
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        50⤵
        
        PID:2528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        50⤵
        
        PID:1952
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        50⤵
        
        PID:5768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        50⤵
        Kills process with taskkill
        
        PID:5672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        50⤵
        
        PID:4648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        50⤵
        
        PID:1688
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        50⤵
        
        PID:5704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        51⤵
        
        PID:3428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        51⤵
        
        PID:4532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        51⤵
        
        PID:5420
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        51⤵
        
        PID:5508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        51⤵
        
        PID:6044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        51⤵
        
        PID:5620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        51⤵
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        51⤵
        
        PID:6064
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        52⤵
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        52⤵
        
        PID:5452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        52⤵
        
        PID:5796
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        52⤵
        
        PID:1344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        52⤵
        
        PID:5132
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        52⤵
        
        PID:2152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        52⤵
        
        PID:4564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        52⤵
        
        PID:2672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        52⤵
        
        PID:4148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        53⤵
        
        PID:2156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        53⤵
        
        PID:5916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        53⤵
        
        PID:3192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        53⤵
        
        PID:1672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        53⤵
        
        PID:3504
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        53⤵
        
        PID:316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        53⤵
        
        PID:3560
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        53⤵
        
        PID:5276
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        54⤵
        
        PID:5364
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        54⤵
        Kills process with taskkill
        
        PID:716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        54⤵
        
        PID:3068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        54⤵
        
        PID:2808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        54⤵
        
        PID:5152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        54⤵
        
        PID:3408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        54⤵
        
        PID:3520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        54⤵
        
        PID:5468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        54⤵
        
        PID:5724
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        55⤵
        
        PID:5244
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        55⤵
        
        PID:5864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        55⤵
        
        PID:4504
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        55⤵
        
        PID:2536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        55⤵
        
        PID:3980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        55⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        55⤵
        
        PID:632
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        55⤵
        
        PID:5716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        56⤵
        
        PID:432
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        56⤵
        
        PID:4648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        56⤵
        
        PID:3732
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        56⤵
        
        PID:5960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        56⤵
        
        PID:3100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        56⤵
        
        PID:6012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        56⤵
        
        PID:1172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        56⤵
        
        PID:6024
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        57⤵
        
        PID:4532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        57⤵
        
        PID:4440
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        57⤵
        
        PID:3360
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        57⤵
        
        PID:5648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        57⤵
        
        PID:5972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        57⤵
        
        PID:5624
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        57⤵
        
        PID:6088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        57⤵
        
        PID:5176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        57⤵
        
        PID:5996
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        58⤵
        
        PID:5836
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        58⤵
        
        PID:2916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        58⤵
        
        PID:404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        58⤵
        
        PID:1764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        58⤵
        
        PID:3236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        58⤵
        
        PID:1296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        58⤵
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        58⤵
        
        PID:4040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        59⤵
        
        PID:5372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        59⤵
        
        PID:5212
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        59⤵
        
        PID:1568
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        59⤵
        
        PID:1320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        59⤵
        
        PID:1524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        59⤵
        Kills process with taskkill
        
        PID:4404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        59⤵
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        59⤵
        
        PID:4148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        60⤵
        
        PID:716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        60⤵
        
        PID:5500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        60⤵
        
        PID:2848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        60⤵
        
        PID:5152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        60⤵
        
        PID:5228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        60⤵
        
        PID:1820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        60⤵
        
        PID:5416
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        60⤵
        
        PID:5888
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:1508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        61⤵
        
        PID:4372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        61⤵
        
        PID:400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        61⤵
        
        PID:5432
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        61⤵
        
        PID:1468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        61⤵
        
        PID:4648
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        61⤵
        
        PID:3124
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        61⤵
        
        PID:2232
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        61⤵
        
        PID:3224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        62⤵
        
        PID:6056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        62⤵
        
        PID:4460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        62⤵
        
        PID:5564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        62⤵
        
        PID:5644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        62⤵
        
        PID:5604
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        62⤵
        
        PID:532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        62⤵
        
        PID:4480
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        62⤵
        
        PID:5704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        63⤵
        
        PID:5476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        63⤵
        
        PID:5608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        63⤵
        
        PID:1540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        63⤵
        
        PID:2056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        63⤵
        
        PID:1284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        63⤵
        
        PID:4564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        63⤵
        
        PID:888
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        63⤵
        
        PID:5816
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        64⤵
        
        PID:5788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        64⤵
        
        PID:4272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        64⤵
        Kills process with taskkill
        
        PID:5804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        64⤵
        
        PID:5196
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        64⤵
        
        PID:1320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        64⤵
        
        PID:4992
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        64⤵
        
        PID:5720
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        64⤵
        
        PID:2168
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        65⤵
        
        PID:5304
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        65⤵
        
        PID:5324
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        65⤵
        
        PID:716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        65⤵
        
        PID:5156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        65⤵
        
        PID:4308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        65⤵
        
        PID:3972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        65⤵
        
        PID:5468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        65⤵
        
        PID:5380
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        65⤵
        
        PID:5316
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        66⤵
        
        PID:4224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        66⤵
        
        PID:6116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        66⤵
        
        PID:4372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        66⤵
        
        PID:5424
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        66⤵
        
        PID:632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        66⤵
        
        PID:5848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        66⤵
        
        PID:4976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        66⤵
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        66⤵
        
        PID:3800
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        67⤵
        
        PID:6104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        67⤵
        
        PID:1172
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        67⤵
        
        PID:5000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        67⤵
        
        PID:1440
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        67⤵
        
        PID:4076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        67⤵
        
        PID:5460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        67⤵
        
        PID:5064
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        67⤵
        
        PID:6112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        68⤵
        
        PID:888
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        68⤵
        
        PID:5704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        68⤵
        
        PID:2156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        68⤵
        
        PID:5916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        68⤵
        
        PID:5200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        68⤵
        
        PID:548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        68⤵
        
        PID:2648
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        68⤵
        
        PID:5452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        69⤵
        
        PID:4200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        69⤵
        
        PID:3496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        69⤵
        Kills process with taskkill
        
        PID:5260
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        69⤵
        
        PID:5544
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        69⤵
        
        PID:5276
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        69⤵
        
        PID:2332
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        69⤵
        
        PID:372
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        69⤵
        
        PID:6116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        70⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        70⤵
        
        PID:4780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        70⤵
        
        PID:5764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        70⤵
        
        PID:4976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        70⤵
        
        PID:1960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        70⤵
        
        PID:4460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        70⤵
        
        PID:6000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        70⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        70⤵
        
        PID:2128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        71⤵
        
        PID:2916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        71⤵
        
        PID:1540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        71⤵
        Kills process with taskkill
        
        PID:2056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        71⤵
        
        PID:1284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        71⤵
        
        PID:6088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        71⤵
        
        PID:4164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        71⤵
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        71⤵
        
        PID:1624
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        72⤵
        
        PID:6024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        72⤵
        
        PID:5868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        72⤵
        Kills process with taskkill
        
        PID:320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        72⤵
        
        PID:1524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        72⤵
        
        PID:4316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        72⤵
        
        PID:5992
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        72⤵
        
        PID:5900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        72⤵
        
        PID:4520
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        72⤵
        
        PID:1272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        73⤵
        
        PID:2720
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        73⤵
        
        PID:5500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        73⤵
        
        PID:5156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        73⤵
        
        PID:4308
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        73⤵
        
        PID:5272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        73⤵
        
        PID:5380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        73⤵
        Kills process with taskkill
        
        PID:2168
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        73⤵
        
        PID:3220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        74⤵
        
        PID:5096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        74⤵
        
        PID:5556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        74⤵
        
        PID:892
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        74⤵
        Kills process with taskkill
        
        PID:5212
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        74⤵
        
        PID:4780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        74⤵
        
        PID:5764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        74⤵
        
        PID:2560
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        74⤵
        
        PID:3564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        75⤵
        
        PID:3968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        75⤵
        
        PID:1780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        75⤵
        
        PID:6000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        75⤵
        
        PID:3224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        75⤵
        
        PID:6116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        75⤵
        
        PID:6020
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        75⤵
        
        PID:3976
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        75⤵
        
        PID:2916
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        76⤵
        
        PID:1764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        76⤵
        
        PID:3568
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        76⤵
        
        PID:3964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        76⤵
        
        PID:6084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        76⤵
        
        PID:4164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        76⤵
        
        PID:5824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        76⤵
        
        PID:3572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        76⤵
        
        PID:6016
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        76⤵
        
        PID:4128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        77⤵
        
        PID:1112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        77⤵
        
        PID:1672
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        77⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        77⤵
        
        PID:4212
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        77⤵
        
        PID:6064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        77⤵
        
        PID:320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        77⤵
        
        PID:3652
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        77⤵
        
        PID:2424
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        78⤵
        
        PID:1524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        78⤵
        
        PID:4496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        78⤵
        
        PID:4584
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        78⤵
        
        PID:1704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        78⤵
        
        PID:4528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        78⤵
        
        PID:3492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        78⤵
        
        PID:1472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        78⤵
        
        PID:3496
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        78⤵
        
        PID:5228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        79⤵
        
        PID:4000
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        79⤵
        
        PID:5380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        79⤵
        Kills process with taskkill
        
        PID:2168
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        79⤵
        
        PID:5752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        79⤵
        
        PID:3636
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        79⤵
        
        PID:2352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        79⤵
        
        PID:5196
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        79⤵
        
        PID:5232
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        80⤵
        
        PID:4768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        80⤵
        
        PID:1996
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        80⤵
        
        PID:3192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        80⤵
        
        PID:4976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        80⤵
        Kills process with taskkill
        
        PID:5028
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        80⤵
        
        PID:4980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        80⤵
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        80⤵
        
        PID:5112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        81⤵
        
        PID:5060
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        81⤵
        
        PID:4948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        81⤵
        
        PID:4136
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        81⤵
        
        PID:1344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        81⤵
        
        PID:1960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        81⤵
        
        PID:6004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        81⤵
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        81⤵
        
        PID:6108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        82⤵
        
        PID:5472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        82⤵
        
        PID:4552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        82⤵
        
        PID:2164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        82⤵
        
        PID:5704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        82⤵
        
        PID:4412
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        82⤵
        
        PID:5460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        82⤵
        
        PID:4500
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        82⤵
        
        PID:5164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        83⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        83⤵
        
        PID:5200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        83⤵
        
        PID:2892
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        83⤵
        Kills process with taskkill
        
        PID:5876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        83⤵
        
        PID:4044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        83⤵
        
        PID:1296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        83⤵
        
        PID:5124
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        83⤵
        
        PID:1624
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        84⤵
        
        PID:4272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        84⤵
        
        PID:5512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        84⤵
        
        PID:2584
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        84⤵
        
        PID:1472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        84⤵
        Kills process with taskkill
        
        PID:3520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        84⤵
        
        PID:5660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        84⤵
        
        PID:6128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        84⤵
        
        PID:3648
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        84⤵
        
        PID:6092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        85⤵
        
        PID:5204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        85⤵
        
        PID:4592
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        85⤵
        
        PID:3560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        85⤵
        
        PID:5264
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        85⤵
        
        PID:3636
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        85⤵
        
        PID:2020
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        85⤵
        
        PID:5244
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        85⤵
        
        PID:5580
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        86⤵
        
        PID:6056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        86⤵
        Kills process with taskkill
        
        PID:4644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        86⤵
        
        PID:1784
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        86⤵
        
        PID:3512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        86⤵
        
        PID:4328
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        86⤵
        
        PID:2100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        86⤵
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        86⤵
        
        PID:844
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        87⤵
        
        PID:512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        87⤵
        Kills process with taskkill
        
        PID:2152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        87⤵
        
        PID:4360
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        87⤵
        
        PID:1780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        87⤵
        
        PID:6080
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        87⤵
        
        PID:760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        87⤵
        Kills process with taskkill
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        87⤵
        
        PID:4004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        88⤵
        Kills process with taskkill
        
        PID:5428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        88⤵
        Kills process with taskkill
        
        PID:1464
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        88⤵
        
        PID:5824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        88⤵
        
        PID:5780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        88⤵
        
        PID:6108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        88⤵
        
        PID:1408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        88⤵
        Kills process with taskkill
        
        PID:3852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        88⤵
        
        PID:5200
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        89⤵
        Kills process with taskkill
        
        PID:3272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        89⤵
        
        PID:4564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        89⤵
        
        PID:5092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        89⤵
        
        PID:5724
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        89⤵
        
        PID:5164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        89⤵
        
        PID:6024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        89⤵
        
        PID:5148
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        89⤵
        
        PID:5468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        90⤵
        
        PID:1980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        90⤵
        
        PID:4824
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        90⤵
        
        PID:5508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        90⤵
        
        PID:3708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        90⤵
        
        PID:4272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        90⤵
        
        PID:5204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        90⤵
        
        PID:5380
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        90⤵
        
        PID:408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        91⤵
        
        PID:1272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        91⤵
        
        PID:3260
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        91⤵
        
        PID:5848
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        91⤵
        
        PID:5764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        91⤵
        
        PID:2172
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        91⤵
        
        PID:3968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        91⤵
        
        PID:5416
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        91⤵
        
        PID:5720
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        92⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        92⤵
        
        PID:2536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        92⤵
        
        PID:4488
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        92⤵
        
        PID:4640
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        92⤵
        
        PID:3960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        92⤵
        Kills process with taskkill
        
        PID:3564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        92⤵
        
        PID:5064
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        92⤵
        
        PID:2152
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        93⤵
        
        PID:1284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        93⤵
        
        PID:208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        93⤵
        
        PID:2228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        93⤵
        
        PID:2116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        93⤵
        
        PID:3572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        93⤵
        
        PID:1736
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        93⤵
        
        PID:6072
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        93⤵
        
        PID:5988
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        93⤵
        
        PID:5948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        94⤵
        
        PID:4076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        94⤵
        
        PID:3892
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        94⤵
        
        PID:5688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        94⤵
        
        PID:5820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        94⤵
        
        PID:4404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        94⤵
        
        PID:4004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        94⤵
        
        PID:3400
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        94⤵
        
        PID:5900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        95⤵
        
        PID:5572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        95⤵
        
        PID:1296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        95⤵
        
        PID:5584
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        95⤵
        
        PID:2720
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        95⤵
        
        PID:4512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        95⤵
        
        PID:3408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        95⤵
        
        PID:6024
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        95⤵
        
        PID:5148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        96⤵
        
        PID:5744
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        96⤵
        
        PID:1524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        96⤵
        
        PID:4028
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        96⤵
        
        PID:1676
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        96⤵
        
        PID:2348
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        96⤵
        Kills process with taskkill
        
        PID:5236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        96⤵
        
        PID:5984
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        96⤵
        
        PID:5436
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        97⤵
        
        PID:3496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        97⤵
        
        PID:3128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        97⤵
        
        PID:5448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        97⤵
        
        PID:4780
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        97⤵
        
        PID:6096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        97⤵
        
        PID:3064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        97⤵
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        97⤵
        
        PID:4608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        98⤵
        
        PID:436
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        98⤵
        
        PID:3512
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        98⤵
        
        PID:1440
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        98⤵
        
        PID:3220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        98⤵
        
        PID:2024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        98⤵
        
        PID:2056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        98⤵
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        98⤵
        
        PID:3644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        99⤵
        
        PID:1960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        99⤵
        
        PID:2916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        99⤵
        
        PID:4152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        99⤵
        
        PID:1864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        99⤵
        
        PID:4340
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        99⤵
        
        PID:6016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        99⤵
        
        PID:4412
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        99⤵
        
        PID:5868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        100⤵
        
        PID:5228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        100⤵
        
        PID:5656
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        100⤵
        
        PID:5140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        100⤵
        
        PID:632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        100⤵
        Kills process with taskkill
        
        PID:2608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        100⤵
        
        PID:5724
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        100⤵
        
        PID:1672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        100⤵
        
        PID:3192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        101⤵
        
        PID:2584
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        101⤵
        
        PID:4660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        101⤵
        
        PID:4900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        101⤵
        
        PID:5744
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        101⤵
        
        PID:5524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        101⤵
        
        PID:972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        101⤵
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        101⤵
        
        PID:3708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        102⤵
        
        PID:2332
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        102⤵
        
        PID:2892
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        102⤵
        
        PID:5652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        102⤵
        
        PID:4304
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        102⤵
        
        PID:5480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        102⤵
        
        PID:5764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        102⤵
        
        PID:5516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        102⤵
        
        PID:4980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        103⤵
        
        PID:4792
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        103⤵
        
        PID:2460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        103⤵
        
        PID:1088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        103⤵
        
        PID:1952
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        103⤵
        Kills process with taskkill
        
        PID:6088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        103⤵
        
        PID:3760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        103⤵
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        103⤵
        
        PID:6084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        104⤵
        
        PID:5680
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        104⤵
        
        PID:3800
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        104⤵
        
        PID:3964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        104⤵
        Kills process with taskkill
        
        PID:1408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        104⤵
        Kills process with taskkill
        
        PID:5728
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        104⤵
        
        PID:4100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        104⤵
        
        PID:4164
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        104⤵
        
        PID:5460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        105⤵
        
        PID:5860
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        105⤵
        
        PID:4552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        105⤵
        
        PID:2932
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        105⤵
        
        PID:5556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        105⤵
        
        PID:5348
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        105⤵
        
        PID:1320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        105⤵
        
        PID:3284
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        105⤵
        
        PID:2560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        106⤵
        
        PID:5372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        106⤵
        
        PID:5164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        106⤵
        
        PID:6064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        106⤵
        
        PID:5880
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        106⤵
        
        PID:4660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        106⤵
        
        PID:1524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        106⤵
        
        PID:748
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        106⤵
        
        PID:1676
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        107⤵
        
        PID:3228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        107⤵
        
        PID:5836
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        107⤵
        
        PID:3560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        107⤵
        
        PID:5652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        107⤵
        
        PID:3260
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        107⤵
        Kills process with taskkill
        
        PID:548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        107⤵
        Kills process with taskkill
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        107⤵
        
        PID:5364
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        108⤵
        
        PID:1700
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        108⤵
        
        PID:5344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        108⤵
        
        PID:452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        108⤵
        
        PID:5644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        108⤵
        
        PID:2024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        108⤵
        
        PID:6076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        108⤵
        Kills process with taskkill
        
        PID:3760
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        108⤵
        
        PID:4948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Discord.exe
        109⤵
        
        PID:3224
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordCanary.exe
        109⤵
        
        PID:4908
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordPTB.exe
        109⤵
        
        PID:5428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im DiscordAlpha.exe
        109⤵
        
        PID:4460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        109⤵
        
        PID:2708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SnippingTool.exe
        109⤵
        
        PID:1464
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Taskmgr.exe
        109⤵
        
        PID:1580
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat"
        109⤵
        
        PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd07ab46f8,0x7ffd07ab4708,0x7ffd07ab4718
  2⤵
  PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd07ab46f8,0x7ffd07ab4708,0x7ffd07ab4718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17494900962968702513,9043377453091322060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17494900962968702513,9043377453091322060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17494900962968702513,9043377453091322060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17494900962968702513,9043377453091322060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17494900962968702513,9043377453091322060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd07ab46f8,0x7ffd07ab4708,0x7ffd07ab4718
  2⤵
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd07ab46f8,0x7ffd07ab4708,0x7ffd07ab4718
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13994860184272505425,1365132603979185391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13994860184272505425,1365132603979185391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13994860184272505425,1365132603979185391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13994860184272505425,1365132603979185391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13994860184272505425,1365132603979185391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd07ab46f8,0x7ffd07ab4708,0x7ffd07ab4718
  2⤵
  PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd07ab46f8,0x7ffd07ab4708,0x7ffd07ab4718
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14406813694819869705,7626080226339701027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14406813694819869705,7626080226339701027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14406813694819869705,7626080226339701027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1476 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14406813694819869705,7626080226339701027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14406813694819869705,7626080226339701027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3628

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2104

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:5372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:408

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3060

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
PID:5748

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3192

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5728

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
PID:2168

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:6116

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
PID:208

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\187836f9-bc69-44a9-b976-3d736271df8e.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
98fc2a82563cd28ecd5cdf19ce05ac5d

SHA1
6e93c558c8f330f20f7d27ebe3e4a2c4dbf5f6e0

SHA256
96c183a9008475d1a0724b871418faf0b8881a0755454ebd3da48d4873a4f1b5

SHA512
083867b887d4bd19f9fb742afd98edcf76c22b26b4e1f96f699fc372f6f8a8cf2616d3dbb21e50bf2f7aed7a466eb650fa8342192d268a6e9b3afd0e10754d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
c881ca3e1d192fb63c171d1b9bb07385

SHA1
facd7774af32ac81beade1ea998981b6263474c3

SHA256
689ba961d83dab67eba83a12b139938cf23478d30d9cade735b5d29c4cbbd6c0

SHA512
2232ff9edda538e16e1b972a22492548112969844d4f1f9043c8ad9628178e798971be4e4367757598d708d694aa9b9f2316e2662fe76efe0ca09bcf567efced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
e3c67f3736434960de3e6ac74b694740

SHA1
f47f23201d13d043ab7be3004b341ecbb4667940

SHA256
1b43c835d6fb6c10005b886683413b9bb3f934c381386483d84fbdf253563201

SHA512
6989a74f078d846666c8beca392a3ccf8b2cfb8d0d022b8d21a1b6ff4801ec62cd170d40ce8eaaa81163307c6c8c15a96ef764efc937d80253691694b24eead2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
8468536125985d3096e71bdc58d2664f

SHA1
c4a98cd09dbb5278b71a975401e17bd2933e3582

SHA256
09a0c3e41445077aeb9628937805bfe26f7b3d6f2de77ac3ea4c37df31d0ed80

SHA512
3ba800887b489dd08b61bdfb7f0f4c632fcb9a8412e39326cd15eb1cde9a8a7c4e20275ae24005fc2786f146b82c9530ab26d14667ba6effc55be576b71433b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
91da4a204e5788ff8da4af103636f2e5

SHA1
68d9f2e217c29a07dc49c3f77e99107d7bb524ed

SHA256
e2eb72b14b9c84e2209db5dad8f6dd62c5386d3218941d4e221af8e2fa1c9d5d

SHA512
857760816d52e4db3843db59f831d674caea6cdae00fedc28b19cdb79bce0b65f52b2b702dc4998fe18d0dcd89cdac52cd4ea5f9a8068c4bd937bd6836de6c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
1939d3cc2ec88365f281afbe30f6f4ff

SHA1
db9f82f48caccc00aa3fedca211cabd6379ad17c

SHA256
809777405b14611f15dd864539d879287810a62a9e63c6c2c8d0ee825e0d45cb

SHA512
ae9c8f8d8f571def213f4e5e41e34cedbc58e18a7782f84187128da3667f5a11f51d7a0f5f4cba3a127e48f45d2b731d41b128c989f036e35f0b33335ae8a3e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
ea62e6186571b369cfa402b63150746b

SHA1
2a9835a72182ba26c1d58c228946f42fb2700246

SHA256
a884f50c6275163af285e32f3da23858102143d46dcf596dfd7c9b2cda30b1ce

SHA512
5703e0eb588ed532f7caf3e661c30b485b6a6ce8728ef588d5f49f6cd3c83674c4736dc458a2393f12e2213d09cf51584581ed4ed7dd853db1ec4cf6376fc453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
218e2d0a81b35f3dcf142c2eddf67383

SHA1
bc73ff8b74e1ee6241b27734079329a03fd61f00

SHA256
df6b7d68dc9555c64f94b98d8f0b46217cb93ab550604bfe395f5415567529e1

SHA512
a2491f340bef6805919e87da1cd2940c4960873146c30b70dfe31163a6376efe6e931523cf1930e62bd08e4e92de80520c9b79f14340ca12075284c1700cd55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d4df1eb27ba7b67ed3b93bf21db0bea

SHA1
24dcec1798120400d1b18f1b8b4e507e354dd285

SHA256
fc064e84510cf2b192e7988eefcf66e0c510cfae16df86b218e4aa96f5bd8d84

SHA512
963bea117da2ad411dfbc9852f8ef7e746a31d9c976b4cae50ad5415581fb07b0888d7bb73460ed1dc20f9be0d92a84228ced1c8cbd735da1fed5b6aa87f5c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52bbcef8569f0cca0ce2582ea6270a46

SHA1
da847e3e709a37259c0ab5871e8732a4cd68d706

SHA256
20fafe33fc9143f199688792efa1fa28b7619277517e49181c11727df23c4237

SHA512
95895903a62e6f9ba9167c5cb57aa76e62c52756c1db57bc14d0ce05b007abd8b66b076b6593423c70f16b8b130d097c08110e256d5b449cbaed3143eac7ff67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c7bc0c85c858f1739916be2f07ee953

SHA1
0eae0ccbaa7fb0b1b6a788035b4a9a69914c8650

SHA256
c9a39371d32f1033aa66a408b7eb9718977c4a37e983224201457bc950db937c

SHA512
e297e9a61aaf55d45fee00b6a2877eb9e131f89433da0940af5aa3c8143a13286da5be578b019f9847f1a54e8d1a0e890f4eaed86708f2a613a36b7b467b37c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
42c6a964bce6e12bc62b3f37e1322d63

SHA1
4cdc391df0e9260ba36ec8b1518dbc7cf507503a

SHA256
d93fc5915e3a8213c6dd51e6966e52d38b3ed5f6bce6d4776a1fb79418055116

SHA512
b2bf0ef777fc00993d4523f95f12c98f88a4a6ccfd975a6175b81222ed949360980cea34c8ac595a6a9001366bd1d4bc0e9b0af3aa41d5ab8d9e4ee5891a5718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
04fd066b6b4389b6c510737d3574408e

SHA1
f58c24b1700e5487e7544f8ac1f785883b97607c

SHA256
e32f0bfcc9c027d587117b47fe03f97e2142c41d0d8e572049a55ba209690299

SHA512
7cfe46ab368245b2ec30a61fe1ac598aaf4f7f74a7c4b14a547ab6bbfdc82b11c2e33d05b73cb19b78829163c77a95896d1a7073fdb0870261ac300bfb6dfcb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
ef0845d80caacfb327d3d18b17f7d6df

SHA1
893897a7863d95980336b304f6491012b780a45c

SHA256
382a1704685d102fe75f2613cd7abc9a930b69d84480672b804eff426a13370d

SHA512
eed7d9b23d7c15d27c1c2e9599b9220cdde4bff4b9b606c9c31d0465d0864fa96858567350a806ece92c3f0fb3e0ac5252c24a29c342a50023152b64a4d36894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
f13de9bc2f02c0332e8598091a9c243b

SHA1
b00a5f567c46fcabc82b143cf416a486e9f4096a

SHA256
6238626314cadf19e91efc6b10f81e08bb121db94c9725469deb1c52b3debf6d

SHA512
8b6928248e646dcb84a0f5a9520cb7ea74fb59bc11a35faba65d573ce0885d8f94c9890dc603cca2a69ce2016720477d6e13bcfaa1781fc983734d94bba7292e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
48KB

MD5
a22ef3ebbf718f112cf94550c121c237

SHA1
f7af6730f91412f6f01e103b4e28f5efab9f4026

SHA256
1cbf884371737e4616f01d1cbc809b6882da93ec0a46056841484395770cad89

SHA512
17cdaeca7e53006937f7550bcd63da497db03fa654b53e42f9adbbb836bfe03a4903ce1dffe8a6ba89fd5b3b70a38894dd6ba3134eacab040fcf2ab6659faf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
32KB

MD5
fb1cb94c375c14c7790d5cc913a57e93

SHA1
482327b5f5bf8010ab60f64cc93af252d753e4d9

SHA256
e1aaabea0167c5faa5d57f49e78c849584f71961ec9dbc968ea85c9afb211771

SHA512
06adf8f5a7561fb51f13e3f350234ca5f6eaf1250fa9680953ad41d634077c3060e1eb418eea60868212bcd69ac63489452d0711bf5d084f76783e521ab13a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
356603f260dfee90e3455e0e132c68a6

SHA1
3dbe22d21c7a643b64b601260ea02b4b9bd6b99b

SHA256
49d1c37ddfa05c3363d03318cad9437ebbd97d2b86a09d8118ed49853b45c641

SHA512
453fc84f51c88577b15ee6e8a324a18f47feaabc35f3197d78da6e329fc51afaa8a37e2b7b67279878d686409d1ce8a6be66858650b9bf39ab91c0c1a8285b7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
5b5c7fe9ec474b72f0270612699a392c

SHA1
b5e4bd63dbcbc8f3284d6014079dce21cc4a0917

SHA256
f3682ec39f4b1de12a2f70acdc09b038a3500810b71ba7f189ed56efdae95eb0

SHA512
ed3e20a139a3072b6e6109cc6703e942c23efb3a1461be0eb22bea2aee455c4563cdf9ca5f3c322e994738c50971289890f86d17cb93b9001a4fdd689020d34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
228B

MD5
6d6d61acaf91eecd79991e9666e2627d

SHA1
6af92b8d77b5d9a20a312c0865ee9cfc590b0502

SHA256
2b3c9fc6bb4e7ca40bd86c2c08781c37c20b891ccec3b8a137c3b91f7fa91ac1

SHA512
f5a56c2759b1d443ac1e276fc69792d34c42870945fac081f78eb483be4c8fe3cc66660f7e106445b7b694f586486a555f1aa1254a1730fa6d8566c7cd159010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
194B

MD5
a48763b50473dbd0a0922258703d673e

SHA1
5a3572629bcdf5586d79823b6ddbf3d9736aa251

SHA256
9bb14ea03c24f4c3543b22a8b4e9d306b926d4950cfcc410808ecac2407409fd

SHA512
536406435e35f8204ce6d3b64850ffb656813aacbc5172af895c16c4f183005d69999c4f48f948875d9837890f290b51a7358ff974fb1efc6ba3d1592426cca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
d9dcf0137be120af8cf2295044425589

SHA1
9da463afe4fb09973ae285ef42dfff355ca17c9f

SHA256
5d0be52dfbf56b3527239e9fa10e3967fbce5a9ac03109b0d487581e23e103b4

SHA512
a56245c060e535ab0de19d99c6afa6f5a4936c004faa1413e2483a8114984da8e6670bdb9d5e34cb5cb384b94611df043082b10067ce9a2fa50c97533abcb316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
98ab8fc71dcfb73cebb86b4aa7ba833b

SHA1
e23e5fed8cf95f674c52e6cb9336f6e91616674e

SHA256
83aa179f3631d60c5a14312807f267ed575af05cf69a07ea922c0059b01e0c25

SHA512
c2c31148b6eea47a93a6bc88aed4e22cf3fdc2132b30fbe6d96c3e0443f714b1c655ccc8f65436f147914a5c78ddcae3242cb1abff07ee7a7168506778ea28a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
fab16be453e203f51173ab474b3f7d5e

SHA1
d96f061a346a26606e1be4cdb0f781165ce18381

SHA256
c1a71f63ec6062a783a357adbb8929be555eb30bcbb8ad263e37591ae74280d7

SHA512
8584f42752fd9ca9e51d5d7f5b4c5f3f5c8fb1a04f6875e50d9ade420ecaf24d73ddd164df5ee8491f7487c14509658d452dd24b6bc6d65ca2a3ce9765081762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
973400a8b053a348f24ef1a8251dc889

SHA1
21de934e1df2967a3b44c182155770e6a3e309eb

SHA256
7c890135ff1e6fb16debda4a4c1c5e59c93f7f3f2c92218b88d2293ad2d806be

SHA512
2187b02a2d5bfa1a8c2a5f7706b0c2443fd2d0f71b06aa3048475f0f961fa447df68be681f48a0fb1d8c6d201ffeb2dd4439b81f2335fa650677e8593012f1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
e3ac4922b5f150ee125accf7b70ccf3c

SHA1
723fd491af54c103f8025d5169fa1949cd272f56

SHA256
929ed5758d3518c22d1928a6fdcc6fabc3c165280f5a836e192ade3b10f57ef2

SHA512
4ee9779b1a4d6ae8850355d431ef4d4345935bb89b125c91c5e4ce7e751daf24b610f79223e3a3d33e6bc48410e339ab465191bde54f4828d4e5d686ce318a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
d6f7ec74c98bcce3cd1ac9fcbd7e94b9

SHA1
960de46874485d8ea041d6949268f213ee62a860

SHA256
c337558ae3dc6c04c078134da1b0da7375b70469c064c289bc12b1cd215cf987

SHA512
13828a31cc2d3cc6ed21c83e4bb83750b3ccd0d1ba3f16041f35b83ccf6f2715d2ba00beb1dd03a76f29acc5eba87c804b1b42d90c3e6d9b506dffc5f015f9b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\urenemy.bat

Filesize
345B

MD5
8eb3f722da88af88475f0034ec6c8d8f

SHA1
7739c7118c3a36edfcc6d9745f39637c9431ba1e

SHA256
5f94cc601240763d351bb6906ee3f336b6527be55136e787a174e51802f06b16

SHA512
e4ef82570ab5fa3cf4c4b86343be1515633e0003a9a27721776e2d5790c13fbd12f6f2c2af8f59f81251ab479feeee42c41a88dd85f8180f0a7aa9307932f2cf

Download Submit
memory/208-163-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-160-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-159-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-158-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-152-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-161-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-162-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-151-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/208-153-0x00000173DDC70000-0x00000173DDC71000-memory.dmp

Filesize
4KB

Download
memory/3628-132-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-144-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-143-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-142-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-140-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-141-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-139-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-138-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-134-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download
memory/3628-133-0x000001D082DF0000-0x000001D082DF1000-memory.dmp

Filesize
4KB

Download