Overview

overview

8

Static

static

3

2026-06-28...at.exe

windows10-2004-x64

7

2026-06-28...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    121s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 19:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 41.9MB
  • Sample260628-yd9fjsdv4n
  • SHA256 76a56ed451586fa0cb3bf66ab00e1d6778355fe66a50411cb9add8e6d3dad03e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 25 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 25 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 26 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\system32\wscript.exe
          wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5684
          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
            5⤵
            • Drops startup file
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2072
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2668
              • C:\Windows\system32\schtasks.exe
                schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3380
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5668
              • C:\Windows\system32\wscript.exe
                wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4576
                • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                  8⤵
                  • Drops startup file
                  • Adds Run key to start application
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:716
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2856
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                      10⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:4528
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2136
                    • C:\Windows\system32\wscript.exe
                      wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2012
                      • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                        11⤵
                        • Drops startup file
                        • Adds Run key to start application
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1768
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1864
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                            13⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:2240
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5008
                          • C:\Windows\system32\wscript.exe
                            wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5572
                            • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                              "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                              14⤵
                              • Drops startup file
                              • Adds Run key to start application
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4728
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5812
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                  16⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4188
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2088
                                • C:\Windows\system32\wscript.exe
                                  wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3020
                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                    17⤵
                                    • Drops startup file
                                    • Adds Run key to start application
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:1144
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2872
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                        19⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1116
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3792
                                      • C:\Windows\system32\wscript.exe
                                        wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4908
                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                          "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                          20⤵
                                          • Drops startup file
                                          • Adds Run key to start application
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:3132
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2664
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                              22⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4420
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4960
                                            • C:\Windows\system32\wscript.exe
                                              wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2388
                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                23⤵
                                                • Drops startup file
                                                • Adds Run key to start application
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1276
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                  24⤵
                                                    PID:2032
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                      25⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5404
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                    24⤵
                                                      PID:3384
                                                      • C:\Windows\system32\wscript.exe
                                                        wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                        25⤵
                                                          PID:3312
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                            26⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1264
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                              27⤵
                                                                PID:4248
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  28⤵
                                                                    PID:4420
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                    28⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5660
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                  27⤵
                                                                    PID:3416
                                                                    • C:\Windows\system32\wscript.exe
                                                                      wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                      28⤵
                                                                        PID:616
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                          29⤵
                                                                            PID:3952
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                        27⤵
                                                                          PID:4148
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                    24⤵
                                                                      PID:4292
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                21⤵
                                                                  PID:940
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                            18⤵
                                                              PID:804
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                        15⤵
                                                        • Drops startup file
                                                        • Adds Run key to start application
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2920
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                          16⤵
                                                            PID:1128
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                              17⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1980
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                            16⤵
                                                              PID:5440
                                                              • C:\Windows\system32\wscript.exe
                                                                wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                17⤵
                                                                  PID:2992
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                    18⤵
                                                                      PID:3388
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                  16⤵
                                                                    PID:2240
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                            12⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2448
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                              13⤵
                                                                PID:2984
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                  14⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:5616
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                13⤵
                                                                  PID:1520
                                                                  • C:\Windows\system32\wscript.exe
                                                                    wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                    14⤵
                                                                      PID:2008
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                        15⤵
                                                                          PID:3784
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                      13⤵
                                                                        PID:2416
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                9⤵
                                                                • Drops startup file
                                                                • Adds Run key to start application
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1300
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                  10⤵
                                                                    PID:4852
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                      11⤵
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:5428
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                    10⤵
                                                                      PID:1016
                                                                      • C:\Windows\system32\wscript.exe
                                                                        wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                        11⤵
                                                                          PID:3800
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                            12⤵
                                                                              PID:5556
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                          10⤵
                                                                            PID:5952
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                    6⤵
                                                                    • Drops startup file
                                                                    • Adds Run key to start application
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2164
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                      7⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:972
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                        8⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:6120
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                      7⤵
                                                                        PID:2148
                                                                        • C:\Windows\system32\wscript.exe
                                                                          wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                          8⤵
                                                                            PID:3280
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                              9⤵
                                                                              • Drops startup file
                                                                              • Adds Run key to start application
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3912
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                10⤵
                                                                                  PID:2660
                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                    schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                    11⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:2228
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                  10⤵
                                                                                    PID:3756
                                                                                    • C:\Windows\system32\wscript.exe
                                                                                      wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                      11⤵
                                                                                        PID:5984
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                          12⤵
                                                                                            PID:5504
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                        10⤵
                                                                                          PID:3152
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                    7⤵
                                                                                      PID:5076
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                              3⤵
                                                                              • Drops startup file
                                                                              • Adds Run key to start application
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1628
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1548
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                  5⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:1412
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3284
                                                                                • C:\Windows\system32\wscript.exe
                                                                                  wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1604
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                    6⤵
                                                                                    • Drops startup file
                                                                                    • Adds Run key to start application
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5624
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                      7⤵
                                                                                        PID:3276
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                          8⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:2772
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                        7⤵
                                                                                          PID:2728
                                                                                          • C:\Windows\system32\wscript.exe
                                                                                            wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                            8⤵
                                                                                              PID:1820
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                9⤵
                                                                                                • Drops startup file
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3496
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                  10⤵
                                                                                                    PID:1148
                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                      schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                      11⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:4716
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                    10⤵
                                                                                                      PID:2936
                                                                                                      • C:\Windows\system32\wscript.exe
                                                                                                        wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                        11⤵
                                                                                                          PID:5312
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                            12⤵
                                                                                                              PID:5728
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                          10⤵
                                                                                                            PID:4496
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                      7⤵
                                                                                                        PID:1188
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                  4⤵
                                                                                                    PID:4900
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                              1⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5180
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                2⤵
                                                                                                • Drops startup file
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2580
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                  3⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4696
                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                    schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                    4⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:4164
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                  3⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4108
                                                                                                  • C:\Windows\System32\wscript.exe
                                                                                                    wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                    4⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3576
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                      5⤵
                                                                                                      • Drops startup file
                                                                                                      • Adds Run key to start application
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1372
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                        6⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4704
                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                          schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                          7⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:5876
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                        6⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2476
                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                          wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                          7⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3928
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                            8⤵
                                                                                                            • Drops startup file
                                                                                                            • Adds Run key to start application
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4212
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                              9⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4328
                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                                10⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:1544
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                              9⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1656
                                                                                                              • C:\Windows\System32\wscript.exe
                                                                                                                wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                10⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1664
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                                  11⤵
                                                                                                                  • Drops startup file
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2024
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                                    12⤵
                                                                                                                      PID:5248
                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                        schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                                        13⤵
                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                        PID:5772
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                                      12⤵
                                                                                                                        PID:4092
                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                          wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                          13⤵
                                                                                                                            PID:260
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                                              14⤵
                                                                                                                              • Drops startup file
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2040
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                                                15⤵
                                                                                                                                  PID:3000
                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                    schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                                                    16⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:1832
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                                                  15⤵
                                                                                                                                    PID:2152
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      16⤵
                                                                                                                                        PID:5772
                                                                                                                                      • C:\Windows\System32\wscript.exe
                                                                                                                                        wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                                        16⤵
                                                                                                                                          PID:2608
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                                                            17⤵
                                                                                                                                              PID:2228
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                          15⤵
                                                                                                                                            PID:4240
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                      12⤵
                                                                                                                                        PID:4988
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                  9⤵
                                                                                                                                  • Drops startup file
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3524
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                                                    10⤵
                                                                                                                                      PID:5444
                                                                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                                                                        schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                                                        11⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:2876
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                                                      10⤵
                                                                                                                                        PID:3244
                                                                                                                                        • C:\Windows\System32\wscript.exe
                                                                                                                                          wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                                          11⤵
                                                                                                                                            PID:3872
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                                                              12⤵
                                                                                                                                                PID:3104
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                            10⤵
                                                                                                                                              PID:6012
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                      6⤵
                                                                                                                                      • Drops startup file
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1724
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                                                        7⤵
                                                                                                                                          PID:3160
                                                                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                                                                            schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                                                            8⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:692
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                                                          7⤵
                                                                                                                                            PID:2616
                                                                                                                                            • C:\Windows\System32\wscript.exe
                                                                                                                                              wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                                              8⤵
                                                                                                                                                PID:2244
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                                                                  9⤵
                                                                                                                                                    PID:4164
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                7⤵
                                                                                                                                                  PID:1844
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                          3⤵
                                                                                                                                          • Drops startup file
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:4896
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin""
                                                                                                                                            4⤵
                                                                                                                                              PID:3456
                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                schtasks /create /tn "WindowsUpdateService" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe" /sc onlogon /f /ru "Admin"
                                                                                                                                                5⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:620
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs"
                                                                                                                                              4⤵
                                                                                                                                                PID:5656
                                                                                                                                                • C:\Windows\System32\wscript.exe
                                                                                                                                                  wscript.exe C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4168
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:816
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-06-28_b4b49599dbe8101cf32dca2b501868c3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
                                                                                                                                                    4⤵
                                                                                                                                                      PID:3436
                                                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                                                sihost.exe
                                                                                                                                                1⤵
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:964
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                  2⤵
                                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2912
                                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                1⤵
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2500
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:5616
                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                1⤵
                                                                                                                                                  PID:3784

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                      • Size 599B
                                                                                                                                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
                                                                                                                                                      • Size 214KB
                                                                                                                                                      • SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _imaging.cp312-win_amd64.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\PIL\_imaging.cp312-win_amd64.pyd
                                                                                                                                                      • Size 2.5MB
                                                                                                                                                      • SHA256 6dfd10a98bc81a1999e2b5ddb8be8c1cfb9a2c8e10258c56a52ee0d8930d3d7f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      VCRUNTIME140.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\VCRUNTIME140.dll
                                                                                                                                                      • Size 106KB
                                                                                                                                                      • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      VCRUNTIME140_1.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\VCRUNTIME140_1.dll
                                                                                                                                                      • Size 48KB
                                                                                                                                                      • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _asyncio.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_asyncio.pyd
                                                                                                                                                      • Size 69KB
                                                                                                                                                      • SHA256 0d4fbd46f922e548060ea74c95e99dc5f19b1df69be17706806760515c1c64fe
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _brotli.cp312-win_amd64.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_brotli.cp312-win_amd64.pyd
                                                                                                                                                      • Size 836KB
                                                                                                                                                      • SHA256 1e4cf067342ee168410560db9bbba370a1b609abc028bff61a3dcc1274dfcd16
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _bz2.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_bz2.pyd
                                                                                                                                                      • Size 82KB
                                                                                                                                                      • SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _ctypes.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_ctypes.pyd
                                                                                                                                                      • Size 121KB
                                                                                                                                                      • SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _hashlib.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_hashlib.pyd
                                                                                                                                                      • Size 63KB
                                                                                                                                                      • SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _lzma.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_lzma.pyd
                                                                                                                                                      • Size 155KB
                                                                                                                                                      • SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _overlapped.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_overlapped.pyd
                                                                                                                                                      • Size 54KB
                                                                                                                                                      • SHA256 5d298bb811037b583cff6c88531f1742fae5eee47c290adb47ddbd0d6126b9cc
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _queue.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_queue.pyd
                                                                                                                                                      • Size 31KB
                                                                                                                                                      • SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _socket.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_socket.pyd
                                                                                                                                                      • Size 81KB
                                                                                                                                                      • SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _sqlite3.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_sqlite3.pyd
                                                                                                                                                      • Size 121KB
                                                                                                                                                      • SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _ssl.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_ssl.pyd
                                                                                                                                                      • Size 173KB
                                                                                                                                                      • SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _wmi.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\_wmi.pyd
                                                                                                                                                      • Size 35KB
                                                                                                                                                      • SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      base_library.zip
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\base_library.zip
                                                                                                                                                      • Size 1.3MB
                                                                                                                                                      • SHA256 902f6023a45046177dc72c33de81c2c5f411c7dfa61a18b7907cc0eedd9f8ed3
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      cd.cp312-win_amd64.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\charset_normalizer\cd.cp312-win_amd64.pyd
                                                                                                                                                      • Size 10KB
                                                                                                                                                      • SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      libcrypto-3.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\libcrypto-3.dll
                                                                                                                                                      • Size 4.9MB
                                                                                                                                                      • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      libffi-8.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\libffi-8.dll
                                                                                                                                                      • Size 38KB
                                                                                                                                                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      libssl-3.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\libssl-3.dll
                                                                                                                                                      • Size 771KB
                                                                                                                                                      • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _multidict.cp312-win_amd64.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\multidict\_multidict.cp312-win_amd64.pyd
                                                                                                                                                      • Size 79KB
                                                                                                                                                      • SHA256 a7411fadf931b119427b537fcc6467f63179a7a7c29c603b89b1bc8be0733f8f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      INSTALLER
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\numpy-2.4.4.dist-info\INSTALLER
                                                                                                                                                      • Size 4B
                                                                                                                                                      • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      _psutil_windows.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\psutil\_psutil_windows.pyd
                                                                                                                                                      • Size 69KB
                                                                                                                                                      • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      python3.DLL
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\python3.DLL
                                                                                                                                                      • Size 66KB
                                                                                                                                                      • SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      python312.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\python312.dll
                                                                                                                                                      • Size 6.6MB
                                                                                                                                                      • SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      pywintypes312.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\pywin32_system32\pywintypes312.dll
                                                                                                                                                      • Size 133KB
                                                                                                                                                      • SHA256 b29e4098f9f53f05e3281636d079de58b05a26c03669cea4ec1673e51750fa31
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      select.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\select.pyd
                                                                                                                                                      • Size 30KB
                                                                                                                                                      • SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Lorem ipsum.txt
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                                                                                                                                      • Size 1KB
                                                                                                                                                      • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      sqlite3.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\sqlite3.dll
                                                                                                                                                      • Size 1.4MB
                                                                                                                                                      • SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ucrtbase.dll
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\ucrtbase.dll
                                                                                                                                                      • Size 987KB
                                                                                                                                                      • SHA256 c446df8432ff2679961763de876432fcf13f272269c17417e7eccbda0b000448
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      unicodedata.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\unicodedata.pyd
                                                                                                                                                      • Size 1.1MB
                                                                                                                                                      • SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      win32crypt.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\win32\win32crypt.pyd
                                                                                                                                                      • Size 122KB
                                                                                                                                                      • SHA256 6d625fbac4e15b0310f19fffc656357eab024132fc514bd587d811d106bc704e
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _quoting_c.cp312-win_amd64.pyd
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI23562\yarl\_quoting_c.cp312-win_amd64.pyd
                                                                                                                                                      • Size 81KB
                                                                                                                                                      • SHA256 3a788a9fc9468ca4d63342e066bce958c973446a8a3dead2656e50d198e203de
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      windowsupdate.vbs
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\windowsupdate.vbs
                                                                                                                                                      • Size 196B
                                                                                                                                                      • SHA256 e48aef0732a02ab7b235043b0b356e509e067dbaa591198f1390a09f5f971694
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      memory/2500-921-0x000001E088AD0000-0x000001E088AF0000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2500-955-0x000001E0992B0000-0x000001E0992D0000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2500-914-0x000001E0853A0000-0x000001E0854A0000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2500-933-0x000001E088D30000-0x000001E088D50000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2500-922-0x000001E098F10000-0x000001E099010000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2912-1103-0x000000000E9F0000-0x000000000F26B000-memory.dmp
                                                                                                                                                      Download