Analysis

  • max time kernel
    153s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2023 09:54

General

  • Target

    NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe

  • Size

    1.5MB

  • MD5

    3dd1804a642a4d96777a807dc9e5ae10

  • SHA1

    972d878cf92f3db5bb503bbce1d3cc8500e3da10

  • SHA256

    9cee271113b514769f1f475d53dc1bbf233044c0fec11038b027a563420d2d2b

  • SHA512

    a2f508e1de292a77a184a6f421c49b2546ddfee0eb566868646274159d30af0ee20405015d8eb3899697d2005d81c1357ec5b0a749bb30bbe1125a5c33311e19

  • SSDEEP

    24576:dbCj2sObHtqQ4QqH0XlE654b4fX3fo8wBgNcP:dbCjPKNqQqH0XSucl

Score
10/10

Malware Config

Signatures

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\File.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\PROGRA~3\File.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 05 localhost
          4⤵
          • Runs ping.exe
          PID:4596
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 05 localhost
          4⤵
          • Runs ping.exe
          PID:2360
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 05 localhost
          4⤵
          • Runs ping.exe
          PID:5540
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 05 localhost
          4⤵
          • Runs ping.exe
          PID:6128
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 05 localhost
          4⤵
          • Runs ping.exe
          PID:5632
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 05 localhost
          4⤵
          • Runs ping.exe
          PID:5688
        • C:\Windows\SysWOW64\cscript.exe
          cscript /nologo C:\Users\Admin\AppData\Local\Temp\tmp.vbs
          4⤵
            PID:2808
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "HostController" /tr "C:\ProgramData\HostController.exe" /f
        2⤵
        • Creates scheduled task(s)
        PID:4744
      • C:\Users\Admin\AppData\Local\Temp\NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
        0
        2⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2416
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
        2⤵
          PID:4412
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
          2⤵
            PID:1792
          • C:\Windows\SysWOW64\schtasks.exe
            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
            2⤵
              PID:2588
            • C:\Windows\SysWOW64\schtasks.exe
              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
              2⤵
                PID:680
              • C:\Windows\SysWOW64\schtasks.exe
                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                2⤵
                  PID:3356
                • C:\Windows\SysWOW64\schtasks.exe
                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                  2⤵
                    PID:1864
                  • C:\Windows\SysWOW64\schtasks.exe
                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                    2⤵
                      PID:628
                    • C:\Windows\SysWOW64\schtasks.exe
                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                      2⤵
                      • Creates scheduled task(s)
                      PID:2060
                    • C:\Windows\SysWOW64\schtasks.exe
                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                      2⤵
                        PID:4148
                      • C:\Windows\SysWOW64\schtasks.exe
                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                        2⤵
                          PID:3048
                        • C:\Windows\SysWOW64\schtasks.exe
                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                          2⤵
                          • Creates scheduled task(s)
                          PID:3920
                        • C:\Windows\SysWOW64\schtasks.exe
                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                          2⤵
                            PID:4092
                          • C:\Windows\SysWOW64\schtasks.exe
                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                            2⤵
                              PID:4424
                            • C:\Windows\SysWOW64\schtasks.exe
                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                              2⤵
                              • Creates scheduled task(s)
                              PID:3576
                            • C:\Windows\SysWOW64\schtasks.exe
                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                              2⤵
                                PID:3508
                              • C:\Windows\SysWOW64\schtasks.exe
                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                2⤵
                                  PID:2600
                                • C:\Windows\SysWOW64\schtasks.exe
                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                  2⤵
                                    PID:4320
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                    2⤵
                                    • Creates scheduled task(s)
                                    PID:2480
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                    2⤵
                                    • Creates scheduled task(s)
                                    PID:64
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                    2⤵
                                      PID:3380
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                      2⤵
                                      • Creates scheduled task(s)
                                      PID:3680
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                      2⤵
                                        PID:1664
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                        2⤵
                                          PID:2664
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                          2⤵
                                            PID:3544
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                            2⤵
                                              PID:3748
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                              2⤵
                                              • Creates scheduled task(s)
                                              PID:1232
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                              2⤵
                                                PID:5140
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                2⤵
                                                • Creates scheduled task(s)
                                                PID:5196
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                2⤵
                                                  PID:5252
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                  2⤵
                                                    PID:5308
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                    2⤵
                                                    • Creates scheduled task(s)
                                                    PID:5372
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                    2⤵
                                                      PID:5436
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                      2⤵
                                                      • Creates scheduled task(s)
                                                      PID:5488
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                      2⤵
                                                        PID:5564
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                        2⤵
                                                          PID:5616
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                          2⤵
                                                            PID:5684
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                            2⤵
                                                              PID:5748
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                              2⤵
                                                                PID:5792
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                2⤵
                                                                • Creates scheduled task(s)
                                                                PID:5844
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                2⤵
                                                                • Creates scheduled task(s)
                                                                PID:5896
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                2⤵
                                                                  PID:5952
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                  2⤵
                                                                  • Creates scheduled task(s)
                                                                  PID:6068
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                  2⤵
                                                                    PID:5268
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                    2⤵
                                                                      PID:2568
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                      2⤵
                                                                        PID:4396
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                        2⤵
                                                                          PID:4284
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                          2⤵
                                                                            PID:1576
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                            2⤵
                                                                              PID:32
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                              2⤵
                                                                                PID:4744
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                2⤵
                                                                                  PID:5504
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                  2⤵
                                                                                    PID:5032
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                    2⤵
                                                                                      PID:4404
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                      2⤵
                                                                                        PID:5412
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                        2⤵
                                                                                          PID:4172
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                          2⤵
                                                                                            PID:4900
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                            2⤵
                                                                                              PID:4596
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                              2⤵
                                                                                                PID:5544
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                2⤵
                                                                                                  PID:5588
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                  2⤵
                                                                                                    PID:5464
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                    2⤵
                                                                                                      PID:5592
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                      2⤵
                                                                                                        PID:5892
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:5944
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                        2⤵
                                                                                                          PID:5832
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                          2⤵
                                                                                                            PID:5800
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                            2⤵
                                                                                                              PID:6104
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                              2⤵
                                                                                                                PID:5388
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                2⤵
                                                                                                                  PID:5328
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                  2⤵
                                                                                                                  • Creates scheduled task(s)
                                                                                                                  PID:228
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                  2⤵
                                                                                                                    PID:1000
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                    2⤵
                                                                                                                      PID:1804
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                      2⤵
                                                                                                                        PID:3588
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                        2⤵
                                                                                                                          PID:2600
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                          2⤵
                                                                                                                          • Creates scheduled task(s)
                                                                                                                          PID:4964
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                          2⤵
                                                                                                                            PID:5152
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                            2⤵
                                                                                                                              PID:5860
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                              2⤵
                                                                                                                                PID:5704
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                2⤵
                                                                                                                                  PID:1976
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                  2⤵
                                                                                                                                    PID:5348
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                    2⤵
                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                    PID:2160
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                    2⤵
                                                                                                                                      PID:3528
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                      2⤵
                                                                                                                                        PID:1780
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                        2⤵
                                                                                                                                          PID:4412
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                          2⤵
                                                                                                                                            PID:5316
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                            2⤵
                                                                                                                                              PID:5168
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                              2⤵
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:5296
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                              2⤵
                                                                                                                                                PID:2880
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:4640
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:4672
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:6108
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5740
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4288
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5788
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5780
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:5868
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5900
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6000
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6092
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6100
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6020
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2568
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                      PID:5036
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1304
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2480
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4284
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:8
                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2556
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5064
                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4868
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:6128
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:4300
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3848
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:5380
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:1656
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:5020
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5152
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5760
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5416
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2380
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5256
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3356
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2004
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                              PID:5920
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:524
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:6096
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                    PID:5388
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5648
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:2360
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3828
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5564
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                PID:3916
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1164
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:2644
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5148
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3796
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:5572
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:5920
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:5652
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5376
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3872
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:812
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                          PID:1060
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:996
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:5588
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1484
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4384
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                      PID:5536
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:228
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:5328
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:3352
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:4548
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:688
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:5312
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3468
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:2952
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:232
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                      PID:5288
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:3288
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:5620
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:5804
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5232
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                        PID:2664
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1400
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4532
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2724
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3692
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5176
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr329.exe" /tr "C:\ProgramData\winmgr329.exe" /f
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4956
                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\HostController.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\ProgramData\HostController.exe
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\winmgr329.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\ProgramData\winmgr329.exe
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:32
                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\HostController.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\ProgramData\HostController.exe
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:4416

                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              71.31.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              71.31.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              208.194.73.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              208.194.73.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              241.154.82.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              241.154.82.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              155.245.36.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              155.245.36.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              155.245.36.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              a23-36-245-155deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              26.35.223.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              26.35.223.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              86.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              86.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              15.164.165.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              15.164.165.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              25.14.97.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              25.14.97.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              25.14.97.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              a104-97-14-25deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              IN CNAME
                                                                                                                                                                                                                                                                                                                                                                              mm-mm.bing.net.trafficmanager.net
                                                                                                                                                                                                                                                                                                                                                                              mm-mm.bing.net.trafficmanager.net
                                                                                                                                                                                                                                                                                                                                                                              IN CNAME
                                                                                                                                                                                                                                                                                                                                                                              dual-a-0001.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                              dual-a-0001.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200
                                                                                                                                                                                                                                                                                                                                                                              dual-a-0001.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              13.107.21.200
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301305_1RDDROWSHG0C525AI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301305_1RDDROWSHG0C525AI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 581331
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: 5DA9EC5BB12841F68F2A897E495984DF Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:44Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:43 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301477_14PVM3YMRTCSD2NZ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301477_14PVM3YMRTCSD2NZ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 694757
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: AF126698C64E4AB79E33DDB85EB15137 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:44Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:43 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301044_1R6E1MOEVCAUYY73I&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301044_1R6E1MOEVCAUYY73I&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 692302
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: D214C3A524BA48539E467003F057B89D Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:44Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:43 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317300961_12GZY3GJPK3SP20HI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317300961_12GZY3GJPK3SP20HI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 737042
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: DC0C9A2014ED4A4D935CA3801121CF0B Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:44Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:43 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301714_1EPLZW0KO7U2RACHB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301714_1EPLZW0KO7U2RACHB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 558814
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: E2503E1B861544DBBE11340340239303 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:44Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:43 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301394_1XQ1UP6CPBEHM2FCF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301394_1XQ1UP6CPBEHM2FCF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 637153
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: D296B257CF134F61BADEF3C2194DA7D9 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:45Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:44 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301209_1YG8XJG78E6WL3S49&pid=21.2&w=1920&h=1080&c=4
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301209_1YG8XJG78E6WL3S49&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 482655
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: 9662FCA838734D32943D8624CE8C79B6 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:45Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:45 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301618_18EK60OU3ULIWMD9V&pid=21.2&w=1080&h=1920&c=4
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301618_18EK60OU3ULIWMD9V&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 508694
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: 0D7359DA60CD465283A2C561C4A2DA42 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:46Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:45 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301103_1AT2QBQ1Q6ANODZ4C&pid=21.2&w=1920&h=1080&c=4
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301103_1AT2QBQ1Q6ANODZ4C&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 470736
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: A223527F34624E309D18505F469852F7 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:46Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:45 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301536_1KEHL2APX3BZOFBAK&pid=21.2&w=1080&h=1920&c=4
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301536_1KEHL2APX3BZOFBAK&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 425124
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: E5BDF209E93E480FA8BBF363C689EE85 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:46Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:45 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301058_17JUKZU9RAC77URQ8&pid=21.2&w=1920&h=1080&c=4
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301058_17JUKZU9RAC77URQ8&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 258667
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: 43D9A5EA948C4A519780613725C83E89 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:46Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:45 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              GET
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301491_1LL1FHWSDTTTRGIZC&pid=21.2&w=1080&h=1920&c=4
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              GET /th?id=OADD2.10239317301491_1LL1FHWSDTTTRGIZC&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                              host: tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              accept: */*
                                                                                                                                                                                                                                                                                                                                                                              accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              HTTP/2.0 200
                                                                                                                                                                                                                                                                                                                                                                              cache-control: public, max-age=2592000
                                                                                                                                                                                                                                                                                                                                                                              content-length: 257431
                                                                                                                                                                                                                                                                                                                                                                              content-type: image/jpeg
                                                                                                                                                                                                                                                                                                                                                                              x-cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-headers: *
                                                                                                                                                                                                                                                                                                                                                                              access-control-allow-methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                              timing-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                              report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                                                                                                                                                                                                                                                                                                                                                                              nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                                                                                                                                                                                                                                                                                                                              accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                              x-msedge-ref: Ref A: C28445A748AC4E2CB65F7D06CFA63139 Ref B: BRU30EDGE0922 Ref C: 2023-11-05T09:55:47Z
                                                                                                                                                                                                                                                                                                                                                                              date: Sun, 05 Nov 2023 09:55:46 GMT
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              200.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              200.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                              200.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              a-0001a-msedgenet
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              13.227.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              13.227.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              58.189.79.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              58.189.79.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              IN PTR
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • flag-us
                                                                                                                                                                                                                                                                                                                                                                              DNS
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              Remote address:
                                                                                                                                                                                                                                                                                                                                                                              8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              Request
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              IN A
                                                                                                                                                                                                                                                                                                                                                                              Response
                                                                                                                                                                                                                                                                                                                                                                            • 204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              tls, http2
                                                                                                                                                                                                                                                                                                                                                                              1.2kB
                                                                                                                                                                                                                                                                                                                                                                              8.3kB
                                                                                                                                                                                                                                                                                                                                                                              16
                                                                                                                                                                                                                                                                                                                                                                              14
                                                                                                                                                                                                                                                                                                                                                                            • 204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              https://tse1.mm.bing.net/th?id=OADD2.10239317301491_1LL1FHWSDTTTRGIZC&pid=21.2&w=1080&h=1920&c=4
                                                                                                                                                                                                                                                                                                                                                                              tls, http2
                                                                                                                                                                                                                                                                                                                                                                              227.5kB
                                                                                                                                                                                                                                                                                                                                                                              6.5MB
                                                                                                                                                                                                                                                                                                                                                                              4725
                                                                                                                                                                                                                                                                                                                                                                              4719

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301305_1RDDROWSHG0C525AI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301477_14PVM3YMRTCSD2NZ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301044_1R6E1MOEVCAUYY73I&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317300961_12GZY3GJPK3SP20HI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301714_1EPLZW0KO7U2RACHB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301394_1XQ1UP6CPBEHM2FCF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301209_1YG8XJG78E6WL3S49&pid=21.2&w=1920&h=1080&c=4

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301618_18EK60OU3ULIWMD9V&pid=21.2&w=1080&h=1920&c=4

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301103_1AT2QBQ1Q6ANODZ4C&pid=21.2&w=1920&h=1080&c=4

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301536_1KEHL2APX3BZOFBAK&pid=21.2&w=1080&h=1920&c=4

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301058_17JUKZU9RAC77URQ8&pid=21.2&w=1920&h=1080&c=4

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200

                                                                                                                                                                                                                                                                                                                                                                              HTTP Request

                                                                                                                                                                                                                                                                                                                                                                              GET https://tse1.mm.bing.net/th?id=OADD2.10239317301491_1LL1FHWSDTTTRGIZC&pid=21.2&w=1080&h=1920&c=4

                                                                                                                                                                                                                                                                                                                                                                              HTTP Response

                                                                                                                                                                                                                                                                                                                                                                              200
                                                                                                                                                                                                                                                                                                                                                                            • 204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              tls, http2
                                                                                                                                                                                                                                                                                                                                                                              1.2kB
                                                                                                                                                                                                                                                                                                                                                                              8.3kB
                                                                                                                                                                                                                                                                                                                                                                              16
                                                                                                                                                                                                                                                                                                                                                                              14
                                                                                                                                                                                                                                                                                                                                                                            • 204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              tls, http2
                                                                                                                                                                                                                                                                                                                                                                              1.2kB
                                                                                                                                                                                                                                                                                                                                                                              8.3kB
                                                                                                                                                                                                                                                                                                                                                                              16
                                                                                                                                                                                                                                                                                                                                                                              14
                                                                                                                                                                                                                                                                                                                                                                            • 204.79.197.200:443
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              tls, http2
                                                                                                                                                                                                                                                                                                                                                                              1.2kB
                                                                                                                                                                                                                                                                                                                                                                              8.2kB
                                                                                                                                                                                                                                                                                                                                                                              16
                                                                                                                                                                                                                                                                                                                                                                              13
                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              71.31.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              71 B
                                                                                                                                                                                                                                                                                                                                                                              157 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              71.31.126.40.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              208.194.73.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              72 B
                                                                                                                                                                                                                                                                                                                                                                              158 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              208.194.73.20.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              241.154.82.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              72 B
                                                                                                                                                                                                                                                                                                                                                                              158 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              241.154.82.20.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              155.245.36.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              72 B
                                                                                                                                                                                                                                                                                                                                                                              137 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              155.245.36.23.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              26.35.223.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              71 B
                                                                                                                                                                                                                                                                                                                                                                              157 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              26.35.223.20.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              86.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              70 B
                                                                                                                                                                                                                                                                                                                                                                              144 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              86.23.85.13.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              15.164.165.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              72 B
                                                                                                                                                                                                                                                                                                                                                                              146 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              15.164.165.52.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              25.14.97.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              71 B
                                                                                                                                                                                                                                                                                                                                                                              135 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              25.14.97.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              62 B
                                                                                                                                                                                                                                                                                                                                                                              173 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              tse1.mm.bing.net

                                                                                                                                                                                                                                                                                                                                                                              DNS Response

                                                                                                                                                                                                                                                                                                                                                                              204.79.197.200
                                                                                                                                                                                                                                                                                                                                                                              13.107.21.200

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              200.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              73 B
                                                                                                                                                                                                                                                                                                                                                                              106 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              200.197.79.204.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              315 B
                                                                                                                                                                                                                                                                                                                                                                              5

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              13.227.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              72 B
                                                                                                                                                                                                                                                                                                                                                                              158 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              13.227.111.52.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              58.189.79.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              71 B
                                                                                                                                                                                                                                                                                                                                                                              145 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              58.189.79.40.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to
                                                                                                                                                                                                                                                                                                                                                                              dns
                                                                                                                                                                                                                                                                                                                                                                              NEAS.3dd1804a642a4d96777a807dc9e5ae10.exe
                                                                                                                                                                                                                                                                                                                                                                              63 B
                                                                                                                                                                                                                                                                                                                                                                              122 B
                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                              1

                                                                                                                                                                                                                                                                                                                                                                              DNS Request

                                                                                                                                                                                                                                                                                                                                                                              appleupdate.uk.to

                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                            • C:\PROGRA~3\File.bat

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              761B

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              583540fd7a2b1c752b10e55c64a0cb00

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              f1d600b36e4c751e71817590a5f02fddc7c0dc4e

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              e2fb0ed137bfacc99f4f879445de3fe61ea469bf382007c8af2611c0879f1ca6

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              db88afc9fdfc86c6026ed0d0e445d720bc0cde682266d3edd2d083a531c5ea91a85dc3075719dd91ac485eff1ed19d3e641f4509945b5a7dd6d322ae730d7a04

                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\HostController.exe

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              9376c10b44ea34fbb6174fd1bcee3d7d

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              ce9a8c8e150aa623d46a0a79cea5f0ae85fc9c7c

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              f90c33e6ed9bde614977235e775e7038ffc531a15e27e0eb34724deced26c7ff

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              dac114166a525ebe3a1284aca98d99a82e3e6c30d063dd8e28e03b1cecac2334e2a42acd2e76b9768c249a9f83fb753022ac999a623147250e6b20a142c46dcf

                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\HostController.exe

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              9376c10b44ea34fbb6174fd1bcee3d7d

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              ce9a8c8e150aa623d46a0a79cea5f0ae85fc9c7c

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              f90c33e6ed9bde614977235e775e7038ffc531a15e27e0eb34724deced26c7ff

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              dac114166a525ebe3a1284aca98d99a82e3e6c30d063dd8e28e03b1cecac2334e2a42acd2e76b9768c249a9f83fb753022ac999a623147250e6b20a142c46dcf

                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\HostController.exe

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              9376c10b44ea34fbb6174fd1bcee3d7d

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              ce9a8c8e150aa623d46a0a79cea5f0ae85fc9c7c

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              f90c33e6ed9bde614977235e775e7038ffc531a15e27e0eb34724deced26c7ff

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              dac114166a525ebe3a1284aca98d99a82e3e6c30d063dd8e28e03b1cecac2334e2a42acd2e76b9768c249a9f83fb753022ac999a623147250e6b20a142c46dcf

                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\winmgr329.exe

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              871f81515a590c97d1a16f6136160005

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              2bfe5195032144edacf997ea950111a7ae185ae1

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              73b6c63399679f6369e3b2a61ae3f83471f5954db51809a530d795072a549431

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              7d322c267408d6fdacaa1d0ce039c6f38c3af5ff239d570f84feeac88c22be464a87978f3aeedb8d4b7a3708648cddc1946dc3f555b80c2f33b9515a75a50837

                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\winmgr329.exe

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              871f81515a590c97d1a16f6136160005

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              2bfe5195032144edacf997ea950111a7ae185ae1

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              73b6c63399679f6369e3b2a61ae3f83471f5954db51809a530d795072a549431

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              7d322c267408d6fdacaa1d0ce039c6f38c3af5ff239d570f84feeac88c22be464a87978f3aeedb8d4b7a3708648cddc1946dc3f555b80c2f33b9515a75a50837

                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp.vbs

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              140B

                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                              a5b9abb102d92b9b384a76ba6f92844c

                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                              7776eab88801c625974a699aa6719200440cba0c

                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                              76b962c2991667590055ce22e62e9b307063e486b79cf70da4f9fc90ef73b51e

                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                              589110ca2c292037fbe2780fb4870d90f3899a29bc7a9face35ae1d448a109311ab345a93527614447f61d3c957b3a4f7c0786c18d95dae0c3ddcd6dd9e16382

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-9-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-13-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-14-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-15-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-12-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-11-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-10-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-8-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-6-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            • memory/2416-4-0x00000000000D0000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                              804KB

                                                                                                                                                                                                                                                                                                                                                                            We care about your privacy.

                                                                                                                                                                                                                                                                                                                                                                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.