b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666

Analysis

max time kernel
900s
max time network
899s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-12-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Client.exe
Size

167KB
MD5

51a555ab580218adcc9475aff3e8225a
SHA1

2f3d05a20edfcd9b9ab3962fb8d236bc24c34414
SHA256

b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666
SHA512

e9e1e3cdca3c2019a27d0ecc220528ed8e01c9607bfeab01a6671c55551d9731ce395aa9c8227e2b8f8b391fb4a631ad26e8a215c5c500100d30e3eb0356f78e
SSDEEP

3072:O6MADoN36tnQviFCtABnqfWl9zxaF9blYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:O/i9zDvM1/JdSI5eb

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\Control Panel\International\Geo\Nation	New Client.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	discord.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.url	discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	discord.exe

Executes dropped EXE 11 IoCs

pid	Process
2020	discord.exe
2164	discord.exe
2560	discord.exe
3044	discord.exe
2652	discord.exe
1832	discord.exe
5148	discord.exe
6000	discord.exe
5960	discord.exe
6328	discord.exe
6924	discord.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .."	discord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .."	discord.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
130	6.tcp.eu.ngrok.io
208	6.tcp.eu.ngrok.io
99	6.tcp.eu.ngrok.io
114	6.tcp.eu.ngrok.io
160	6.tcp.eu.ngrok.io
182	6.tcp.eu.ngrok.io
15	6.tcp.eu.ngrok.io
38	6.tcp.eu.ngrok.io
82	6.tcp.eu.ngrok.io
145	6.tcp.eu.ngrok.io
195	6.tcp.eu.ngrok.io
223	6.tcp.eu.ngrok.io
52	6.tcp.eu.ngrok.io
67	6.tcp.eu.ngrok.io
173	6.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
5208	taskkill.exe
6088	taskkill.exe
6884	taskkill.exe
7036	taskkill.exe
3424	taskkill.exe
4592	taskkill.exe
3668	taskkill.exe
456	taskkill.exe
5336	taskkill.exe
2672	taskkill.exe
1136	taskkill.exe
2884	taskkill.exe
1284	taskkill.exe
5976	taskkill.exe
5676	taskkill.exe
788	taskkill.exe
3384	taskkill.exe
3032	taskkill.exe
5984	taskkill.exe
3436	taskkill.exe
4208	taskkill.exe
2784	taskkill.exe
516	taskkill.exe
3224	taskkill.exe
3124	taskkill.exe
1124	taskkill.exe
5196	taskkill.exe
6356	taskkill.exe
980	taskkill.exe
4364	taskkill.exe
1152	taskkill.exe
5040	taskkill.exe
7056	taskkill.exe
6960	taskkill.exe
2184	taskkill.exe
4728	taskkill.exe
5452	taskkill.exe
6544	taskkill.exe
6236	taskkill.exe
6280	taskkill.exe
4896	taskkill.exe
440	taskkill.exe
5176	taskkill.exe
5716	taskkill.exe
6772	taskkill.exe
3180	taskkill.exe
5464	taskkill.exe
2800	taskkill.exe
4372	taskkill.exe
4588	taskkill.exe
392	taskkill.exe
2952	taskkill.exe
5268	taskkill.exe
960	taskkill.exe
1116	taskkill.exe
4748	taskkill.exe
1676	taskkill.exe
5412	taskkill.exe
560	taskkill.exe
6624	taskkill.exe
4264	taskkill.exe
2236	taskkill.exe
1784	taskkill.exe
1172	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4604	schtasks.exe
2856	schtasks.exe
720	schtasks.exe
5108	schtasks.exe
2456	schtasks.exe
2916	schtasks.exe
4812	schtasks.exe
1576	schtasks.exe
5340	schtasks.exe
4028	schtasks.exe
940	schtasks.exe
2160	schtasks.exe
2600	schtasks.exe
2824	schtasks.exe
5780	schtasks.exe
5560	schtasks.exe
4644	schtasks.exe
1016	schtasks.exe
3316	schtasks.exe
4972	schtasks.exe
3184	schtasks.exe
3644	schtasks.exe
4336	schtasks.exe
5396	schtasks.exe
5644	schtasks.exe
3848	schtasks.exe
5648	schtasks.exe
5796	schtasks.exe
3940	schtasks.exe
6244	schtasks.exe
2680	schtasks.exe
2356	schtasks.exe
5312	schtasks.exe
5456	schtasks.exe
5928	schtasks.exe
7160	schtasks.exe
6976	schtasks.exe
7116	schtasks.exe
3836	schtasks.exe
3896	schtasks.exe
2516	schtasks.exe
6156	schtasks.exe
6788	schtasks.exe
952	schtasks.exe
376	schtasks.exe
5992	schtasks.exe
5556	schtasks.exe
2500	schtasks.exe
7100	schtasks.exe
6916	schtasks.exe
3944	schtasks.exe
1660	schtasks.exe
4548	schtasks.exe
2108	schtasks.exe
4800	schtasks.exe
5672	schtasks.exe
2156	schtasks.exe
3064	schtasks.exe
3780	schtasks.exe
6004	schtasks.exe
6572	schtasks.exe
6384	schtasks.exe
2264	schtasks.exe
6136	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2020	discord.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe
Token: SeIncBasePriorityPrivilege	2020	discord.exe
Token: 33	2020	discord.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2020	4596	New Client.exe	84
PID 4596 wrote to memory of 2020	4596	New Client.exe	84
PID 4596 wrote to memory of 2020	4596	New Client.exe	84
PID 4596 wrote to memory of 4124	4596	New Client.exe	85
PID 4596 wrote to memory of 4124	4596	New Client.exe	85
PID 4596 wrote to memory of 4124	4596	New Client.exe	85
PID 4124 wrote to memory of 788	4124	cmd.exe	87
PID 4124 wrote to memory of 788	4124	cmd.exe	87
PID 4124 wrote to memory of 788	4124	cmd.exe	87
PID 2020 wrote to memory of 4208	2020	discord.exe	93
PID 2020 wrote to memory of 4208	2020	discord.exe	93
PID 2020 wrote to memory of 4208	2020	discord.exe	93
PID 2020 wrote to memory of 600	2020	discord.exe	95
PID 2020 wrote to memory of 600	2020	discord.exe	95
PID 2020 wrote to memory of 600	2020	discord.exe	95
PID 2020 wrote to memory of 2512	2020	discord.exe	97
PID 2020 wrote to memory of 2512	2020	discord.exe	97
PID 2020 wrote to memory of 2512	2020	discord.exe	97
PID 2020 wrote to memory of 980	2020	discord.exe	104
PID 2020 wrote to memory of 980	2020	discord.exe	104
PID 2020 wrote to memory of 980	2020	discord.exe	104
PID 2020 wrote to memory of 4504	2020	discord.exe	106
PID 2020 wrote to memory of 4504	2020	discord.exe	106
PID 2020 wrote to memory of 4504	2020	discord.exe	106
PID 2020 wrote to memory of 2272	2020	discord.exe	108
PID 2020 wrote to memory of 2272	2020	discord.exe	108
PID 2020 wrote to memory of 2272	2020	discord.exe	108
PID 2020 wrote to memory of 3200	2020	discord.exe	110
PID 2020 wrote to memory of 3200	2020	discord.exe	110
PID 2020 wrote to memory of 3200	2020	discord.exe	110
PID 2020 wrote to memory of 1560	2020	discord.exe	112
PID 2020 wrote to memory of 1560	2020	discord.exe	112
PID 2020 wrote to memory of 1560	2020	discord.exe	112
PID 2020 wrote to memory of 4304	2020	discord.exe	114
PID 2020 wrote to memory of 4304	2020	discord.exe	114
PID 2020 wrote to memory of 4304	2020	discord.exe	114
PID 2020 wrote to memory of 4264	2020	discord.exe	116
PID 2020 wrote to memory of 4264	2020	discord.exe	116
PID 2020 wrote to memory of 4264	2020	discord.exe	116
PID 2020 wrote to memory of 5088	2020	discord.exe	118
PID 2020 wrote to memory of 5088	2020	discord.exe	118
PID 2020 wrote to memory of 5088	2020	discord.exe	118
PID 2020 wrote to memory of 4644	2020	discord.exe	120
PID 2020 wrote to memory of 4644	2020	discord.exe	120
PID 2020 wrote to memory of 4644	2020	discord.exe	120
PID 2020 wrote to memory of 756	2020	discord.exe	122
PID 2020 wrote to memory of 756	2020	discord.exe	122
PID 2020 wrote to memory of 756	2020	discord.exe	122
PID 2020 wrote to memory of 2028	2020	discord.exe	124
PID 2020 wrote to memory of 2028	2020	discord.exe	124
PID 2020 wrote to memory of 2028	2020	discord.exe	124
PID 2020 wrote to memory of 2152	2020	discord.exe	126
PID 2020 wrote to memory of 2152	2020	discord.exe	126
PID 2020 wrote to memory of 2152	2020	discord.exe	126
PID 2020 wrote to memory of 2404	2020	discord.exe	128
PID 2020 wrote to memory of 2404	2020	discord.exe	128
PID 2020 wrote to memory of 2404	2020	discord.exe	128
PID 2020 wrote to memory of 4908	2020	discord.exe	130
PID 2020 wrote to memory of 4908	2020	discord.exe	130
PID 2020 wrote to memory of 4908	2020	discord.exe	130
PID 2020 wrote to memory of 2916	2020	discord.exe	132
PID 2020 wrote to memory of 2916	2020	discord.exe	132
PID 2020 wrote to memory of 2916	2020	discord.exe	132
PID 2020 wrote to memory of 4364	2020	discord.exe	134

C:\Users\Admin\AppData\Local\Temp\New Client.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Roaming\discord.exe
  "C:\Users\Admin\AppData\Roaming\discord.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:32
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:8
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:7056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:7104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:7036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:788

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:2164

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:2560

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:3044

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:2652

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:1832

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:5148

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:6000

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:5960

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:6328

C:\Users\Admin\AppData\Roaming\discord.exe
"C:\Users\Admin\AppData\Roaming\discord.exe"
1⤵
- Executes dropped EXE
PID:6924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\discord.exe.log

Filesize
319B

MD5
cdab7719c71b2844a3e7ff9e41894b8a

SHA1
8e6e0e55695e468eb3c237f21340c9d30cab922c

SHA256
e84a57ed5465aaca393476f6271a2413dddad154cbae40827c4639bfc0b3e3eb

SHA512
ec92e8fc3ce02336eea401f9db823ac0a2ad87bb41130f493e72f3c5ca100a461d6296a710afcc93e1fe1fc8630c5e0029e17f58583520077a3c80ad794d9dc9

Download Submit
C:\Users\Admin\AppData\Roaming\discord.exe

Filesize
167KB

MD5
51a555ab580218adcc9475aff3e8225a

SHA1
2f3d05a20edfcd9b9ab3962fb8d236bc24c34414

SHA256
b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666

SHA512
e9e1e3cdca3c2019a27d0ecc220528ed8e01c9607bfeab01a6671c55551d9731ce395aa9c8227e2b8f8b391fb4a631ad26e8a215c5c500100d30e3eb0356f78e

Download Submit
memory/2020-14-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/2020-16-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/2020-15-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/2020-22-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/4596-0-0x0000000075362000-0x0000000075363000-memory.dmp

Filesize
4KB

Download
memory/4596-1-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/4596-2-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/4596-17-0x0000000075362000-0x0000000075363000-memory.dmp

Filesize
4KB

Download
memory/4596-20-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/4596-19-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads