b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666

Analysis

max time kernel
899s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-12-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Client.exe
Size

167KB
MD5

51a555ab580218adcc9475aff3e8225a
SHA1

2f3d05a20edfcd9b9ab3962fb8d236bc24c34414
SHA256

b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666
SHA512

e9e1e3cdca3c2019a27d0ecc220528ed8e01c9607bfeab01a6671c55551d9731ce395aa9c8227e2b8f8b391fb4a631ad26e8a215c5c500100d30e3eb0356f78e
SSDEEP

3072:O6MADoN36tnQviFCtABnqfWl9zxaF9blYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:O/i9zDvM1/JdSI5eb

Score

7^/10

discovery persistence

Malware Config

Signatures

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	discord.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.url	discord.exe

Executes dropped EXE 10 IoCs

pid	Process
5064	discord.exe
3656	discord.exe
820	discord.exe
1128	discord.exe
4664	discord.exe
4800	discord.exe
5144	discord.exe
5464	discord.exe
6900	discord.exe
6480	discord.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .."	discord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .."	discord.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
1	6.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
4020	taskkill.exe
2960	taskkill.exe
420	taskkill.exe
3544	taskkill.exe
3456	taskkill.exe
5312	taskkill.exe
5740	taskkill.exe
3824	taskkill.exe
4624	taskkill.exe
2808	taskkill.exe
2568	taskkill.exe
5984	taskkill.exe
6328	taskkill.exe
3408	taskkill.exe
2252	taskkill.exe
2032	taskkill.exe
1352	taskkill.exe
5756	taskkill.exe
6864	taskkill.exe
1740	taskkill.exe
2264	taskkill.exe
5824	taskkill.exe
5996	taskkill.exe
5072	taskkill.exe
4756	taskkill.exe
5936	taskkill.exe
6952	taskkill.exe
876	taskkill.exe
5308	taskkill.exe
6884	taskkill.exe
6116	taskkill.exe
5656	taskkill.exe
5944	taskkill.exe
6264	taskkill.exe
4604	taskkill.exe
3936	taskkill.exe
872	taskkill.exe
2464	taskkill.exe
5624	taskkill.exe
5376	taskkill.exe
7136	taskkill.exe
4956	taskkill.exe
712	taskkill.exe
4332	taskkill.exe
6520	taskkill.exe
4932	taskkill.exe
1696	taskkill.exe
3168	taskkill.exe
1160	taskkill.exe
2968	taskkill.exe
2056	taskkill.exe
1612	taskkill.exe
1228	taskkill.exe
6296	taskkill.exe
2112	taskkill.exe
3776	taskkill.exe
5124	taskkill.exe
7008	taskkill.exe
5012	taskkill.exe
5068	taskkill.exe
5608	taskkill.exe
7164	taskkill.exe
6224	taskkill.exe
680	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6716	schtasks.exe
4760	schtasks.exe
2312	schtasks.exe
2476	schtasks.exe
1572	schtasks.exe
5428	schtasks.exe
7044	schtasks.exe
4572	schtasks.exe
4264	schtasks.exe
1592	schtasks.exe
1520	schtasks.exe
6036	schtasks.exe
6368	schtasks.exe
1948	schtasks.exe
3192	schtasks.exe
2796	schtasks.exe
6092	schtasks.exe
6592	schtasks.exe
788	schtasks.exe
2052	schtasks.exe
908	schtasks.exe
5760	schtasks.exe
3152	schtasks.exe
5204	schtasks.exe
6556	schtasks.exe
3780	schtasks.exe
4084	schtasks.exe
2628	schtasks.exe
4968	schtasks.exe
5704	schtasks.exe
5752	schtasks.exe
6616	schtasks.exe
1544	schtasks.exe
4356	schtasks.exe
5920	schtasks.exe
5888	schtasks.exe
6284	schtasks.exe
7124	schtasks.exe
1988	schtasks.exe
5416	schtasks.exe
6828	schtasks.exe
6408	schtasks.exe
3272	schtasks.exe
4900	schtasks.exe
7148	schtasks.exe
1472	schtasks.exe
2044	schtasks.exe
6204	schtasks.exe
6288	schtasks.exe
2152	schtasks.exe
6128	schtasks.exe
5744	schtasks.exe
6788	schtasks.exe
4576	schtasks.exe
3940	schtasks.exe
2124	schtasks.exe
2616	schtasks.exe
6624	schtasks.exe
6196	schtasks.exe
4848	schtasks.exe
5548	schtasks.exe
5436	schtasks.exe
5008	schtasks.exe
5680	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5064	discord.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe
Token: SeIncBasePriorityPrivilege	5064	discord.exe
Token: 33	5064	discord.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 5064	3796	New Client.exe	77
PID 3796 wrote to memory of 5064	3796	New Client.exe	77
PID 3796 wrote to memory of 5064	3796	New Client.exe	77
PID 3796 wrote to memory of 1940	3796	New Client.exe	78
PID 3796 wrote to memory of 1940	3796	New Client.exe	78
PID 3796 wrote to memory of 1940	3796	New Client.exe	78
PID 1940 wrote to memory of 1924	1940	cmd.exe	80
PID 1940 wrote to memory of 1924	1940	cmd.exe	80
PID 1940 wrote to memory of 1924	1940	cmd.exe	80
PID 5064 wrote to memory of 4668	5064	discord.exe	81
PID 5064 wrote to memory of 4668	5064	discord.exe	81
PID 5064 wrote to memory of 4668	5064	discord.exe	81
PID 5064 wrote to memory of 880	5064	discord.exe	83
PID 5064 wrote to memory of 880	5064	discord.exe	83
PID 5064 wrote to memory of 880	5064	discord.exe	83
PID 5064 wrote to memory of 3564	5064	discord.exe	85
PID 5064 wrote to memory of 3564	5064	discord.exe	85
PID 5064 wrote to memory of 3564	5064	discord.exe	85
PID 5064 wrote to memory of 1640	5064	discord.exe	89
PID 5064 wrote to memory of 1640	5064	discord.exe	89
PID 5064 wrote to memory of 1640	5064	discord.exe	89
PID 5064 wrote to memory of 2332	5064	discord.exe	91
PID 5064 wrote to memory of 2332	5064	discord.exe	91
PID 5064 wrote to memory of 2332	5064	discord.exe	91
PID 5064 wrote to memory of 4760	5064	discord.exe	93
PID 5064 wrote to memory of 4760	5064	discord.exe	93
PID 5064 wrote to memory of 4760	5064	discord.exe	93
PID 5064 wrote to memory of 1740	5064	discord.exe	95
PID 5064 wrote to memory of 1740	5064	discord.exe	95
PID 5064 wrote to memory of 1740	5064	discord.exe	95
PID 5064 wrote to memory of 868	5064	discord.exe	97
PID 5064 wrote to memory of 868	5064	discord.exe	97
PID 5064 wrote to memory of 868	5064	discord.exe	97
PID 5064 wrote to memory of 2076	5064	discord.exe	99
PID 5064 wrote to memory of 2076	5064	discord.exe	99
PID 5064 wrote to memory of 2076	5064	discord.exe	99
PID 5064 wrote to memory of 2112	5064	discord.exe	101
PID 5064 wrote to memory of 2112	5064	discord.exe	101
PID 5064 wrote to memory of 2112	5064	discord.exe	101
PID 5064 wrote to memory of 2492	5064	discord.exe	103
PID 5064 wrote to memory of 2492	5064	discord.exe	103
PID 5064 wrote to memory of 2492	5064	discord.exe	103
PID 5064 wrote to memory of 4792	5064	discord.exe	105
PID 5064 wrote to memory of 4792	5064	discord.exe	105
PID 5064 wrote to memory of 4792	5064	discord.exe	105
PID 5064 wrote to memory of 3764	5064	discord.exe	107
PID 5064 wrote to memory of 3764	5064	discord.exe	107
PID 5064 wrote to memory of 3764	5064	discord.exe	107
PID 5064 wrote to memory of 4548	5064	discord.exe	109
PID 5064 wrote to memory of 4548	5064	discord.exe	109
PID 5064 wrote to memory of 4548	5064	discord.exe	109
PID 5064 wrote to memory of 1544	5064	discord.exe	111
PID 5064 wrote to memory of 1544	5064	discord.exe	111
PID 5064 wrote to memory of 1544	5064	discord.exe	111
PID 5064 wrote to memory of 2020	5064	discord.exe	113
PID 5064 wrote to memory of 2020	5064	discord.exe	113
PID 5064 wrote to memory of 2020	5064	discord.exe	113
PID 5064 wrote to memory of 4128	5064	discord.exe	115
PID 5064 wrote to memory of 4128	5064	discord.exe	115
PID 5064 wrote to memory of 4128	5064	discord.exe	115
PID 5064 wrote to memory of 3104	5064	discord.exe	117
PID 5064 wrote to memory of 3104	5064	discord.exe	117
PID 5064 wrote to memory of 3104	5064	discord.exe	117
PID 5064 wrote to memory of 2968	5064	discord.exe	119

C:\Users\Admin\AppData\Local\Temp\New Client.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Roaming\discord.exe
  "C:\Users\Admin\AppData\Roaming\discord.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:32
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:8
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:1160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:3456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:4332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:5376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:5796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:7100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:7136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:7072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:5684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:7008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:7012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:7088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - Kills process with taskkill
    PID:6296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:7080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im discord.exe
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    PID:6192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\discord.exe
    3⤵
    PID:6756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:1924

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:3656

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:820

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:5144

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:6900

C:\Users\Admin\AppData\Roaming\discord.exe
C:\Users\Admin\AppData\Roaming\discord.exe
1⤵
- Executes dropped EXE
PID:6480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\discord.exe.log

Filesize
319B

MD5
2a0834560ed3770fc33d7a42f8229722

SHA1
c8c85f989e7a216211cf9e4ce90b0cc95354aa53

SHA256
8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6

SHA512
c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82

Download Submit
C:\Users\Admin\AppData\Roaming\discord.exe

Filesize
167KB

MD5
51a555ab580218adcc9475aff3e8225a

SHA1
2f3d05a20edfcd9b9ab3962fb8d236bc24c34414

SHA256
b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666

SHA512
e9e1e3cdca3c2019a27d0ecc220528ed8e01c9607bfeab01a6671c55551d9731ce395aa9c8227e2b8f8b391fb4a631ad26e8a215c5c500100d30e3eb0356f78e

Download Submit
memory/3796-0-0x00000000750F1000-0x00000000750F2000-memory.dmp

Filesize
4KB

Download
memory/3796-1-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download
memory/3796-2-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download
memory/3796-13-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download
memory/3796-15-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download
memory/5064-11-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download
memory/5064-12-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download
memory/5064-19-0x00000000750F0000-0x00000000756A1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads