f2d326e1410bbcea1360c88f95012e1010eb01247ddfb0c65ec563ebc920678c

Analysis

max time kernel
113s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 35.5MB
Sample260708-cghlcahs81
SHA256 f2d326e1410bbcea1360c88f95012e1010eb01247ddfb0c65ec563ebc920678c
MD5 f5e6d0c0508780d808e27c00c5223dbb
SHA1 628550e6fedc91ebe1e89991ca9b9cdc9a2ef33a
SHA512 8b1798a076fc2a1272cb2fb93011940537e6332df8c506c6b4e60b17dc08a30b92e5edf2f9c03274f718cf07cfc2460149360fa63adbced14ff4975d220d0934
SSDEEP 786432:g2fa7KZJ1QtIV1dyOe4UA1snjyDELCuA67SV4viyBGvYAMs:gMa7KZniIV1QOIqZ+iCiy
TLSH
T1658733F5915200B7EAE2027882FAD17CE22B75DF87F6D88F156410176E479E68C36F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4960	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2244	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4156	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5316	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4044	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1252	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5672	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5088	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3756	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4068	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4704	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2592	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1404	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5872	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1080	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6140	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5744	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2108	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4204	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2144	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1260	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5156	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4040	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4036	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3980	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5236	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3436	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3972	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1328	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4248	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1856	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5888	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5944	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5740	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6076	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6000	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4932	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4276	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2292	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5748	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4232	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3560	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1472	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2448	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5836	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1756	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1656	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5304	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	972	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5912	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3320	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2972	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6036	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1556	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6040	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5812	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5712	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5652	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6028	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5012	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 5160	3340	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	86
PID 5160 wrote to memory of 5896	5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	87
PID 5160 wrote to memory of 2564	5160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 2564 wrote to memory of 2596	2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 2564 wrote to memory of 4776	2564	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 4776 wrote to memory of 4148	4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 4776 wrote to memory of 4960	4776	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 4960 wrote to memory of 1408	4960	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 4960 wrote to memory of 2244	4960	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 2244 wrote to memory of 5060	2244	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 2244 wrote to memory of 4156	2244	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 4156 wrote to memory of 2624	4156	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 4156 wrote to memory of 5316	4156	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 5316 wrote to memory of 4692	5316	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 5316 wrote to memory of 4044	5316	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 4044 wrote to memory of 4104	4044	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 4044 wrote to memory of 1252	4044	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 1252 wrote to memory of 3000	1252	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 1252 wrote to memory of 5672	1252	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 5672 wrote to memory of 2392	5672	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 5672 wrote to memory of 5088	5672	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 5088 wrote to memory of 480	5088	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 5088 wrote to memory of 3756	5088	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 3756 wrote to memory of 5320	3756	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 3756 wrote to memory of 4068	3756	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 4068 wrote to memory of 3544	4068	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 4068 wrote to memory of 4704	4068	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 4704 wrote to memory of 1844	4704	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 4704 wrote to memory of 2592	4704	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 2592 wrote to memory of 1924	2592	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 2592 wrote to memory of 1404	2592	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 1404 wrote to memory of 4072	1404	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 1404 wrote to memory of 5872	1404	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 5872 wrote to memory of 1188	5872	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 5872 wrote to memory of 1080	5872	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 1080 wrote to memory of 1528	1080	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	138
PID 1080 wrote to memory of 6140	1080	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 6140 wrote to memory of 3404	6140	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	141
PID 6140 wrote to memory of 5744	6140	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 5744 wrote to memory of 4552	5744	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 5744 wrote to memory of 2108	5744	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 2108 wrote to memory of 4944	2108	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	147
PID 2108 wrote to memory of 4204	2108	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 4204 wrote to memory of 252	4204	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	150
PID 4204 wrote to memory of 2144	4204	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 2144 wrote to memory of 1168	2144	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	153
PID 2144 wrote to memory of 1260	2144	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	155
PID 1260 wrote to memory of 2808	1260	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	156
PID 1260 wrote to memory of 5156	1260	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	158
PID 5156 wrote to memory of 5300	5156	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	159
PID 5156 wrote to memory of 4040	5156	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	161
PID 4040 wrote to memory of 256	4040	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	162
PID 4040 wrote to memory of 4160	4040	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	164
PID 4160 wrote to memory of 5764	4160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	165
PID 4160 wrote to memory of 4036	4160	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	167
PID 4036 wrote to memory of 2752	4036	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	168
PID 4036 wrote to memory of 3980	4036	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	170
PID 3980 wrote to memory of 3988	3980	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	171
PID 3980 wrote to memory of 5236	3980	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	173
PID 5236 wrote to memory of 5948	5236	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	174
PID 5236 wrote to memory of 3436	5236	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	176
PID 3436 wrote to memory of 4000	3436	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	177
PID 3436 wrote to memory of 3972	3436	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	179
PID 3972 wrote to memory of 5040	3972	2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	180

C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5896
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
    3⤵
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
      4⤵
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        6⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        8⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        9⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        10⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        10⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        11⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        12⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        12⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        13⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        14⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        14⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        15⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        16⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        16⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        17⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        18⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        18⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        19⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        20⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        20⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        21⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        22⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        22⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        23⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        24⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        24⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        25⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        26⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        26⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        27⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        28⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        28⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        29⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        30⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        30⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        31⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        32⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        32⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        33⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        34⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        34⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        35⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        35⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        36⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        36⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        37⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        37⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        38⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        38⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        39⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        39⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        40⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        40⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        41⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        41⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        42⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        42⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        43⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        43⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        44⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        44⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        45⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        46⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        46⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        47⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        48⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        48⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        49⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        50⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        50⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        51⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        52⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        52⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        53⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        54⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        54⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        55⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        56⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        56⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        57⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        58⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        58⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        59⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        60⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        60⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        61⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        62⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        62⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        63⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        63⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        64⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        64⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        65⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        66⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        66⤵
        
        PID:3592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        67⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        67⤵
        
        PID:5512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        68⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        68⤵
        
        PID:4392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        69⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        69⤵
        
        PID:2672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        70⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        70⤵
        
        PID:3604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        71⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        71⤵
        
        PID:5036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        72⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        72⤵
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        73⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        73⤵
        
        PID:976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        74⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        74⤵
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        75⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        75⤵
        
        PID:3272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        76⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        76⤵
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        77⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        77⤵
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        78⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        78⤵
        
        PID:1960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        79⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        79⤵
        
        PID:4732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        80⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        80⤵
        
        PID:1420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        81⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        81⤵
        
        PID:1520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        82⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        82⤵
        
        PID:5008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        83⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        83⤵
        
        PID:624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        84⤵
        
        PID:4016
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        85⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        84⤵
        
        PID:5900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        85⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        85⤵
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        86⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        86⤵
        
        PID:808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        87⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        87⤵
        
        PID:1684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        88⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        88⤵
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        89⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        89⤵
        
        PID:5996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        90⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        90⤵
        
        PID:2260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        91⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        91⤵
        
        PID:2308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        92⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        92⤵
        
        PID:4384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        93⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        93⤵
        
        PID:2748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        94⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        94⤵
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        95⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        95⤵
        
        PID:1396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        96⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        96⤵
        
        PID:2940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        97⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        97⤵
        
        PID:2624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        98⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        98⤵
        
        PID:5104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        99⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        99⤵
        
        PID:2688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        100⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        100⤵
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        101⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        101⤵
        
        PID:5792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        102⤵
        
        PID:6096
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        103⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        102⤵
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        103⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        103⤵
        
        PID:3292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        104⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        104⤵
        
        PID:6104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        105⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        105⤵
        
        PID:1156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        106⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        106⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        107⤵
        
        PID:4024
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        108⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        107⤵
        
        PID:3432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        108⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        108⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        109⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        109⤵
        
        PID:5044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        110⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        110⤵
        
        PID:5952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        111⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        111⤵
        
        PID:1924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        112⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        112⤵
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        113⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        113⤵
        
        PID:4560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        114⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        114⤵
        
        PID:6160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        115⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        115⤵
        
        PID:6220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        116⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        116⤵
        
        PID:6288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        117⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        117⤵
        
        PID:6356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        118⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        118⤵
        
        PID:6424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        119⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        119⤵
        
        PID:6488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        120⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        120⤵
        
        PID:6552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        121⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        121⤵
        
        PID:6620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        122⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        122⤵
        
        PID:6692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        123⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        123⤵
        
        PID:6756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        124⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        124⤵
        
        PID:6824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        125⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        125⤵
        
        PID:6896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        126⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        126⤵
        
        PID:6960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        127⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        127⤵
        
        PID:7032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        128⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        128⤵
        
        PID:7104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        129⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        129⤵
        
        PID:7160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        130⤵
        
        PID:6156
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        131⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        130⤵
        
        PID:6208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        131⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        131⤵
        
        PID:6272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        132⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        132⤵
        
        PID:6392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        133⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        133⤵
        
        PID:6476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        134⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        134⤵
        
        PID:4424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        135⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        135⤵
        
        PID:3268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        136⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        136⤵
        
        PID:6744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        137⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        137⤵
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        138⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        138⤵
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        139⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        139⤵
        
        PID:4900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        140⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        140⤵
        
        PID:5272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        141⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        141⤵
        
        PID:6992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        142⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        142⤵
        
        PID:3636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        143⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        143⤵
        
        PID:4872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        144⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        144⤵
        
        PID:7128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        145⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        145⤵
        
        PID:2944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        146⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        146⤵
        
        PID:6248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        147⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        147⤵
        
        PID:6348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        148⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        148⤵
        
        PID:6468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        149⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        149⤵
        
        PID:6528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        150⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        150⤵
        
        PID:4164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        151⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        151⤵
        
        PID:2032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        152⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        152⤵
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        153⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        153⤵
        
        PID:6804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        154⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        154⤵
        
        PID:2388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        155⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        155⤵
        
        PID:4168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        156⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        156⤵
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        157⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        157⤵
        
        PID:1224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        158⤵
        
        PID:7084
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        159⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        158⤵
        
        PID:7132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        159⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        159⤵
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        160⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        160⤵
        
        PID:1500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        161⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        161⤵
        
        PID:6336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        162⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        162⤵
        
        PID:2744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        163⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        163⤵
        
        PID:6580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        164⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        164⤵
        
        PID:264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        165⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        165⤵
        
        PID:6800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        166⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        166⤵
        
        PID:6860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        167⤵
        
        PID:2064
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        168⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        167⤵
        
        PID:6004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        168⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        168⤵
        
        PID:3144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        169⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        169⤵
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        170⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        170⤵
        
        PID:6244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        171⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        171⤵
        
        PID:5956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        172⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        172⤵
        
        PID:6524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        173⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        173⤵
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        174⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        174⤵
        
        PID:2000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        175⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        175⤵
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        176⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        176⤵
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        177⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        177⤵
        
        PID:6060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        178⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        178⤵
        
        PID:1948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        179⤵
        
        PID:1564
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        180⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        179⤵
        
        PID:6396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        180⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        180⤵
        
        PID:6668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        181⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        181⤵
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        182⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        182⤵
        
        PID:6092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        183⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        183⤵
        
        PID:2104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        184⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        184⤵
        
        PID:3856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        185⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        185⤵
        
        PID:3512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        186⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        186⤵
        
        PID:1100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        187⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        187⤵
        
        PID:1952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        188⤵
        
        PID:5800
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        189⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        188⤵
        
        PID:6156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        189⤵
        
        PID:988
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        190⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        189⤵
        
        PID:6644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        190⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        190⤵
        
        PID:796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        191⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        191⤵
        
        PID:712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        192⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        192⤵
        
        PID:6196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        193⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        193⤵
        
        PID:6652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        194⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        194⤵
        
        PID:2128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        195⤵
        
        PID:2548
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        196⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        195⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        196⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        196⤵
        
        PID:3424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        197⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        197⤵
        
        PID:7000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        198⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        198⤵
        
        PID:4816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        199⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        199⤵
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        200⤵
        
        PID:4072
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        201⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        200⤵
        
        PID:1208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        201⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        201⤵
        
        PID:1644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        202⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        202⤵
        
        PID:7188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        203⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        203⤵
        
        PID:7252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        204⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        204⤵
        
        PID:7336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        205⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        205⤵
        
        PID:7404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        206⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        206⤵
        
        PID:7476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        207⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        207⤵
        
        PID:7540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        208⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        208⤵
        
        PID:7608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        209⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        209⤵
        
        PID:7672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        210⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        210⤵
        
        PID:7804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        211⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        211⤵
        
        PID:7892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        212⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        212⤵
        
        PID:7972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        213⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        213⤵
        
        PID:8060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        214⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        214⤵
        
        PID:8140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        215⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        215⤵
        
        PID:4104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        216⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        216⤵
        
        PID:7220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        217⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        217⤵
        
        PID:5640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        218⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        218⤵
        
        PID:7444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        219⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        219⤵
        
        PID:7524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        220⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        220⤵
        
        PID:7576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        221⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        221⤵
        
        PID:256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        222⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        222⤵
        
        PID:5704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        223⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        223⤵
        
        PID:7844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        224⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        224⤵
        
        PID:1572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        225⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        225⤵
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        226⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        226⤵
        
        PID:6432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        227⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        227⤵
        
        PID:7184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        228⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        228⤵
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        229⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        229⤵
        
        PID:7324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        230⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        230⤵
        
        PID:7368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        231⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        231⤵
        
        PID:6836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        232⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        232⤵
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        233⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        233⤵
        
        PID:7660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        234⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        234⤵
        
        PID:6284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        235⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        235⤵
        
        PID:7964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        236⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        236⤵
        
        PID:8000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        237⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        237⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        238⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        238⤵
        
        PID:7236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        239⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        239⤵
        
        PID:5056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        240⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        240⤵
        
        PID:7440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        241⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        241⤵
        
        PID:2040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        242⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        242⤵
        
        PID:7632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        243⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        243⤵
        
        PID:7696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        244⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        244⤵
        
        PID:6232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        245⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        245⤵
        
        PID:6364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        246⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        246⤵
        
        PID:6496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        247⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        247⤵
        
        PID:6564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        248⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        248⤵
        
        PID:6484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        249⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        249⤵
        
        PID:3316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        250⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        250⤵
        
        PID:5232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        251⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        251⤵
        
        PID:6908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        252⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        252⤵
        
        PID:5768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        253⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        253⤵
        
        PID:3556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        254⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        254⤵
        
        PID:2508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        255⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        255⤵
        
        PID:3056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        256⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-08_f5e6d0c0508780d808e27c00c5223dbb_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install browser_cookie3 --quiet --disable-pip-version-check
        256⤵
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        257⤵
        
        PID:7380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 27954e62e12d115bb1540db4bb9de6e2c852d914aea61cba3c203595138537b2
MD5 5cca64ee98121c203b415d577f6568d7
SHA1 9631e26d8ee54e41f7898b50088fce857eceb48b
SHA512 6386f4c4dd650d7885353419f2eaad6382b166c85006aca5be80d167b3e69d30d33fe3c06e7c5467fc39737db65d9c8f248377d3304d213a1d880c0d3c225d5c
SSDEEP 192:DROPW2hWxca8LxydkeR+1WOqxANmTsX01k9z3AJOWv1j3TLo0/:DREW2hWxcaGAYF0oR9zwPvLoU
TLSH
T1E5A23A875EB8A143FA9F9E700298E6437C3CABCB5850E4653595F20C18D77DADB0472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 6f22ff5bf9d53b7f2c3fcd553d9b8664ef5401912194b8e599e4dbd8f3105405
MD5 11ad1c350e57420b840ced2afda9a05e
SHA1 91056d502d3168ba4e51ac7893cab3868b3a4cc4
SHA512 8df296ce0362431707b02592d75f1c003b33fafec9ebe7e7af1fdb368c7be848f8450626e564818938b2b9e71baae2a4290991c1c6ef87f9df246c748b9b1755
SSDEEP 192:QW2hWNca8LxydkeR+G4ztLVQcNpcspKLX01k9z3A8l:QW2hWNcaGA7sCscmeR9zXl
TLSH
T1D9A23A874B78D002FEDAAEB052A4DA437D3CA7DB2990942625D5F1041CA77C9EB2472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 c5dc0df2fcc456c2b08392ea7d539d43549d04d14ed83d69cd46f79b9e34902a
MD5 b513fd176ee9a5fa4ed96bfa8681ec4e
SHA1 f115d1bb2948e47c51fb883a0ad2cec786c35643
SHA512 b9fdbcd1325dfe393bf2812bfea88f544a99ecc1a66a01656767938f0d8bc82f4d5ac3e806b5d29a705d9a583ea4343b63eb986bd2a62bdce198111ec3a431fc
SSDEEP 192:TW2hWTBca8LxydkeR+stnZNpA1wki+X01k9z3A1Wh:TW2hWdcaGAd9ki+R9zEo
TLSH
T157A24BC297B8E043EE9B9E7042E4DA537C3CA7CB5D90C9661684F1182C977DDAB1063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 9ff8300ecf0ebd4c8130800b5b8857b6ddf21902264af42fb1ac15c794115864
MD5 6a33a9f3dff3f81f6ac8b199e46b9737
SHA1 1346164f9b8b7dec4f3027c27a3b408d025b055b
SHA512 d11e950d80f71ed1534993142975990bf1d62ce6c8829a5b477815dc1f20bb98f445c409bf255495278d7fc75f5bd796119e20a95e4a28e1d9f371c79622bce3
SSDEEP 192:ZqDmxD3XBW2hWs39ca8LxydkeR+awlPg9dxP3NGmVX01k9z3As80L4:4D8BW2hWs39caGAfwqNP3U0R9zj804
TLSH
T118A239C74778A083FDAFAE7052A8EA437D3CA7C60A90955515D4E6542CE33C5EB2073D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 39174763da266b4b955e27eecaef15d8283bb77f9eca94fe925d4928f37a4fa1
MD5 59ddd4d171303a61def209d886cc08fb
SHA1 38ebaa2c8f1fc2e6e31f04d583b7427474fbe3a8
SHA512 087a38ddbdad302e4e2e3e932e8338626dc3cc08a4cd58e84ddd87b666f6407beb569d1cc056c3b3349851edc1ac6fda435065bfc67c4df08ccbbd2ddb053005
SSDEEP 192:br5W2hWjca8LxydkeR+oaUPcqW8xYqD0cSX01k9z3AJL8Fg5W:br5W2hWjcaGA9alCvDyR9zELr5W
TLSH
T175A249C65B785042FDDBAD7052A8EA933C3DB7C70D90D9560694F5481CA37C9EB20A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 a9660f0e3ab6032bba0b75e1d02ce0bc57c9043bca423477843a7a3af1b1c200
MD5 b11d7274ec876b8799104a070fc31e75
SHA1 b959c2e380b95c183e3dc26e63868493e2911e05
SHA512 0113701b9556eade925cabbd51869113e9dad92da96c0b65ecaeaeb6b6c69a35f505a1c3e0c9c1f135a6e50f7e545a34d290ce006e8f57aa644f68589f3b2756
SSDEEP 192:+nwhDPvVr8rFTswW2hWmZca8Lxyf7LRroihrSw/FiGz5j4HsX01k9z3Ac/O0v:+wJPvVreW2hWucaGAf7pofw/nR9zPn
TLSH
T131C21787C6B4F64AF98E9E3151A6C903A83853C7082085961BD4D79D3CF738AE3D85A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 445a2c24c8565834e1e41e4c617d2f9cf5def8e4a477e55e2f18583845b24c1d
MD5 fdb151f9c2a99ff9843ff1cf07b0e648
SHA1 9ab5c2b252ab12a9250620bfa792cacdac7537bf
SHA512 0baa933c74e8794a12c949e42d5242107da5c34ba9a9c960e90d61d44e096c609da95290fecdb19c380eca20b491cd4d1b67c7913ca7e090b96a9b2a9f4b591d
SSDEEP 192:hVeBW2hWfca8LxydkeR+w2LqwdhTsX01k9z3AJOWTxzC57:h0BW2hWfcaGAsL/dhoR9zwtxW
TLSH
T1FFA24AC257789083FA9B6E7012E8D6937C3CA3CB1D90986615D4F1581CA37CAEA1477E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 94f7611fa4568f4577deba250c1254a3c83ffc7b4fd2f00243f3bfac5a993fd8
MD5 25edbbc33347a1425ee23a1d7a6cb4ec
SHA1 2ecc8b7f21b6c2d426db5496466f140b0b10ba82
SHA512 230423af863037a6e5c14f3814472ea3faa56647217c8ea7dc5f1e1c279209a09296ffaa2869037ef61d7995fa89aa07057e56d3f16a4c23159260c696d3db7f
SSDEEP 192:+sW2hWY6Oca8LxydkeR+qnz5j4HsX01k9z3Ac/9T2Gu:+sW2hWYHcaGAD3R9zPNo
TLSH
T169A24AC2C7789442FAAA5E704398E6637C3CB7CB2990C45616D4E2481CE77C9DB14B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 d655a217f4c17982b4c5ecb406290885c74afba361dd840c4245c0b28e07c192
MD5 ac8333e8b1294df2187e41bc3473f6cf
SHA1 497770450fd6e0e07d94ffb5aaf31602acc3cd07
SHA512 fe5894bbec307fefc020e6044f319e98715340f82cce435027912a0a3abd47e23821294274ca174190d694f72562eee9866c77575773a84ab8c46621320462ca
SSDEEP 384:hoxlFW2hWwcaGAf7pofGkFec5ap9R9zYhlP:qPbdezA/9zE
TLSH
T14EA25BCA8778A003F9AB6EB042E5EA673C3CA7D71950955618D4F10C2C937C5EB29B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 69b0f1e099dac7ffbbf1260eb4818abeacd2b9cf105b742b16e6bd5dda3bf035
MD5 4f3772ed964e993f0dbbef152621d6e7
SHA1 ca2249909fc4e38076991a5d4753cbd14dcd457e
SHA512 8fada2323034374e15d2ffde5f4a05e8df418eaca6ed295b5efc2b7348682d7df1875db0e9a47e9f0ffaa01935b831136fba8d5793cf352f02d167e36d43e095
SSDEEP 192:FzKW2hWNca8LxydkeR+/3F846IfgtUX01k9z3AW9KT3TYwg:9KW2hWNcaGAw3FR1tR9z3o8l
TLSH
T147A23AC29B7CA403FAEE6EB01298DA437C3CA7CB1D51C42616C5E15828977C9EB2473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 87622d07bb5c9fa5ccd9f74ac70a1e2ae0cdf54462f90f365178a15a814bf3c4
MD5 3312ee2d0f34b7603be92e62a9237b98
SHA1 ce5ddfdbd501f255b3e2240fdd18ba9412173b68
SHA512 873b096d02f862c126a7d6eee06d40bfc079a98368f4e4ad0cc446a62a9becc28e595f55af828ec6f6e922507c7484ba2f20d9092ff6fc278abb1362e72a6ae0
SSDEEP 384:ETvuBL3B9W2hW0bcaGA8yUE3Sl8BR9z96cR:FBL3BrN1bjJ3B9zkO
TLSH
T1DDA23AC29B7CA042F9EB9E705264D6437C3D63CB5950E87A06E8F25818E33C5EB1467D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 79ec668286cb900c66e1caf8a47309d986c9dc4d37a5d2dcedb2ff2a973896d9
MD5 bfdce1f7bd47a57c0e87582b56feb2d0
SHA1 b5ac9ed5d734cafc6c9d0a3466ccc2844960dc61
SHA512 18b331c18911ba1106ea64df88b1fe0139daeed7407a18be5f9cebed0b635f49b35c8efe634be13db71253476249f366c7f67421d1656a6fea20c8546a198312
SSDEEP 384:0naOMw3zdp3bwjGzue9/0jCRrndbNW2hWKcaGAf7pofyPGTYAsR9zCW2U8N:FOMwBprwjGzue9/0jCRrndbb1bdejMj4
TLSH
T1E6A24B96D3A4E307F94DD9707057D9427C3867860862E98603E1EB1C68F378AEBA536C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 7f12e6eb9a992ea199bcfc755eea488a8889cd2642dba00e49fb06a14bec8408
MD5 e6df7387562b7da98bbb304d6adb1024
SHA1 dd6366a5e364dae03ab1d7ee71a8c3a188cdfebd
SHA512 5220dcf985b6d2501a48ad7febfc3b664a0155b86a1ad1c6da55fc0c15a7060f1a04bde22729e464bdad950fb9a2fb07a72ccfcd32c294c9688e0b4686dd82de
SSDEEP 192:9TfW2hW1ca8Lxyf7LRroihrSC2RzlgnKug8X01k9z3AAF8m0/:ZfW2hW1caGAf7pofCsl8BR9z9dA
TLSH
T1E9A24B9687789803F9EB9D708295DB537C3EA7C71890A56612E4F1042CE73C5EB2473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 daf13af507230a92191c348611e8b31bc384055ea5b9a6d18057646d93bfe4f7
MD5 6a04ee1c0b09011993a3add2900388b1
SHA1 646b6ba762f772db813d568fc513ab3dc9f217cb
SHA512 4c438b34464508c718f78b39f9f0ad48475f8b86141a3467b71fc771c57c9a4e8b8af9b2b5bab60fcab25ea3a5f72f75efc04070375dbac98caff97a2d6525a5
SSDEEP 192:TW2hWmeca8Lxyf7LRroihrSwViQcNpcspKLX01k9z3A8MG:TW2hWhcaGAf7pofwrscmeR9zX1
TLSH
T1B8A24BD68768D002FA9F6EB042E5C9133C3C97CB2D50D915A6D4F4582CA77C8E73466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 74d809270a418e4bc1d3b94348094f00463635cedfbadd97d29686a6d037d2da
MD5 8557ced01b57f200a0f30cfaa9c4af0e
SHA1 507db54f21066f5bb6aa672f2f74d5b792cc6d72
SHA512 edfbc37e203e648483194f2c714054612e66fc48b64a207708dc4d25bf069153a0398fc30d784ebe2249cc2493b13adb3d6b31f37d1c666c77acdcd0cf643abf
SSDEEP 192:/YF6EW2hWSca8LxydkeR+Y3eTREiTMAAUYX01k9z3ALfWXfwDL7ZF:AFxW2hWScaGAH38MgYR9zSfyfwTZF
TLSH
T1CCA24BC6A6BCA002FECA6D705299E5673C3CA7E71DA0C46152D4E2182CE7395E744B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 6620a7962adb6a25a51e13add907189763b76d0816a356465d135eeeed1065a0
MD5 9edaf9f95bb1ddad23ef7c5bb00de810
SHA1 1f73ce1815910dfb6d0d7d24d296ee8cdf960e90
SHA512 e6766b8336ef9ba4e66df1fba1efb867291ffb178ed6b22e2d4416e1bacae2a5f41d71d37311afedb64fdaf04d0441fe8f9b38c98ecac9317131dc208aaba56b
SSDEEP 384:ick1JzNcKSIPW2hWrcaGA8pvifX7R9zUX8fp/uQ:kcKSEKbA6F9zUMf9F
TLSH
T1E6A23BD186BCE183F88EAD706285E6237D7D93860C65857105D4F2983DFB3CAD62463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 82850eb2e7d100938ebd419440e4575750999bc9e349cd074019e413673d02c8
MD5 b3c4eca47635796a499354af78e569de
SHA1 a7fb2ffb3561086f70dc0e7a76c9e37213d9eac0
SHA512 b34ac057f9dafa1c32f1725af7305a66d76397986d3d2be7235e26365efafefa92ae4b4be09c8ef9135bd67adbff6a677f6b0946452508fea0fddfd155c0b853
SSDEEP 384:n4DfIeqW2hWEcaGAn04sowGOrjR9zcX4d:3eSTbjjwGOrF9zq4d
TLSH
T147A218818B7C9042FAEB5EB06294EA933C3DA7C75960C96215D0F25C1CE7396EB1423D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 b43119bdfc7c562bf07c26e01b7b862aa8dc9d5e795798fe93969111244ed2da
MD5 9f8f59ccf126fe7752b45593862b77d4
SHA1 dc211a3c925655cf7dc2b798312fe22f26d3e7ca
SHA512 74d580a21ac9d96c379262a780c992ceaf2c3fe2c19fdbb4a634bea9b23578c888f1e903ed149a35098269aa082a8bd92dd7f0d5a07c24af10a8de15f8b11260
SSDEEP 192:BW2hWsFca8LxydkeR+BbBMHCE/Sv6dlX01k9z3A47ZchWB6:BW2hWsFcaGAMdE/S+R9zn7qG6
TLSH
T137A23BC2973C9043FA9BAE7052E4DA537C3DA7C76DA0856605D4F2582CA33C9BB1463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 bd0cff402e3f64baaf2bfb17d86b2c4c7d03584ea2601ca5c55de147a769a32a
MD5 0fe0355a5e36cd3dee10353249eb0a46
SHA1 9b6c958e32cfcdb7dad1519bd13fdede63b16045
SHA512 7ccd4f6fb6127d30988f25c81ccb7891a6a94362a9c9e6917958e5d9063685f3c5244157dd4669ed7ea31f270cd56f870071060ac94be08018441f8f79d3d664
SSDEEP 384:mGeVnW2hW3caGAf7pofaKWMgYR9zSfym1:mGeVpibde/tgE9z21
TLSH
T191A24BDA97689002FDDA2EB01299DE673C3DABC31DA09A6205E5F1481CD73D4EB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 1985000499475faf541b17c8acbce788bcdba6dddd3b8910b6730238f1c18862
MD5 7bab8cd1fa214d6de752165580b92557
SHA1 2ef6ed7dd5413a424f46358b3a500739f93ac6a6
SHA512 0aa4acac3c77d8a0bd6319f3342d1bf3ee9b8584d3c488d0a639352f7921cc2359827b3a56cc37c1d37b0b2a7ee18c7cb0700bb01f9b086aac808d255960f96d
SSDEEP 192:9GyMvr3W2hWjca8LxydkeR+e0B8kgg6bV46X01k9z3A7EAzOzD:9GyMvbW2hWjcaGAL0BhgtFR9zeEACzD
TLSH
T1AAA23A839B789006FE8A5E701299EA43BC3CA7C71DA0D5A522D4F1481CE33D9DB14B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 055544d562ca50d49443926bca396de985735f7451806ff2565486e406809d25
MD5 80c461242a59eb50085619922e7cbb25
SHA1 204abe872b53d800a4ec710d7ac2603fd5f18a3e
SHA512 5c86b363c0447230183c0beb660d67c294ea2fc268c2fb792719df714ec0e2d11e511f55ec15ea898bd0fedb2c79d35cce131c3f8de1511bed1faee0200c3279
SSDEEP 384:Miwidv3V0dfpkXc0vVaGFW2hWvcaGACe7kcDR9zM6xTox:VHdv3VqpkXc0vVaw6bR7B9zMPx
TLSH
T18BA22887E3E4B143F99FED7082C6D9537C3857C64960C87626D4E6282CA37C9EB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-synch-l1-2-0.dll
Size 22KB
SHA256 0d8f2f7d031f143110c9bf5bdd4f75b24e8b41319fa2e20f78068c084e0d7603
MD5 74cb67262d1d6305ad88ca194da3d53f
SHA1 77f2d609f47d50ddf191e7d1411a89accf63543b
SHA512 a005e8a807aa448b62c9b89f01edafc9d5257a21625410c3cdabc78ad244c439255171ea09f346dc5a4066d83e3b2c605749b1c03a822999f1288db1f69bc370
SSDEEP 384:ZtZ3GW2hWgcaGAf7pof7NPGTYAsR9zCCd:sLbdecMj9zdd
TLSH
T151A25BDA87686103FA9BAD7083D6DA533C3C6BC71D60651316E9E1091CF33D5EA14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-sysinfo-l1-1-0.dll
Size 22KB
SHA256 8010d006df2d62839c933d3b5998abc7a7830ffe32ca68b17c76f3292f5e56ec
MD5 7bc2a31f376cf3b2cbf9be760905de0e
SHA1 8291cdefffd1072c99f10467ee5ce5668a7330a1
SHA512 638e3c9f90fc1192c5e000b5cac9aa0ab0d2ee7c8a0c2eaa1dd14e616e3ca58123a862a7d1acdce408a109fde60827f5a6e2865c2e1ad31d3ec06829600f86db
SSDEEP 192:agdKIMF3mavW2hWXca8LxydkeR+CAFSA0+HTeQZNiBX01k9z3AIsPr/c4vx5:vu7vW2hWXcaGArAFaQq/R9zZCr/TT
TLSH
T12FA21982A7B8A102F99A6E70A1D5E6437C38ABC72C51C45906D4E3185DF33C9AB2463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-timezone-l1-1-0.dll
Size 22KB
SHA256 1789f5e749cf3a5d419e3b835bd9d78a077ee77f3e761f0fbf3609e38ace6f40
MD5 65a995eaf06202392453b37cfc8e459f
SHA1 69707ab23d628b5446102d3387c172449128ade6
SHA512 c0414ca69cdd52099c0931211daafa3ca6efe330b367785f5c8f67efc7d298ba87fb0afed8e8e03587a56fe5e9202f411a480da1071ddff5350324e6d2003bbf
SSDEEP 192:gzW2hWmGca8Lxyf7LRroihrSl6XpUHWX01k9z3AKCj45VvH:gzW2hWpcaGAf7pofl0pjR9zLCs/H
TLSH
T1F4A22AC3DB289402FDCF2EB052A9D9537C3CA7D70960A55649D6E0092CEB789EB2472C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-core-util-l1-1-0.dll
Size 22KB
SHA256 c893a59c4d1fa86fb50d486ebf3a873244b910efec5b00690d4a20afb7ce0761
MD5 ac4cf03b7a2f5757121f917214c2720d
SHA1 1b1e5ed1cea44be003c7b4acf3f86711885e1537
SHA512 41d8c3621c641b6865fd3aca7361c689e09706545e0e1b5221f05bc251ab5f1b46fda70a78b12240376295af22f6e631ce68615cb4c7a15e475b2d0d7e939758
SSDEEP 192:SlyW2hWjca8LxydkeR+Yhf1TOwGOr49uX01k9z3AFXGwDp:WyW2hWjcaGAVp0wGOrjR9zcX3t
TLSH
T186A23AC28BBCD042FDAB6E7062D8EA437C3CA7C75990949159D4F15828E37C5EB1463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-conio-l1-1-0.dll
Size 22KB
SHA256 9e466e76079b73bd9b0114004d040d193dc982e4150eee1241a902d16c2bda38
MD5 9898df995b7e317efb1278de089a9fd1
SHA1 78196b60beabbdd71835df4f47ec3d6b1e347a29
SHA512 82333d8ddbdd03874473c2b2ca3676cee0aa8ee486d60093f4dfcd4b48a42eb141214cbaa65dc26d891bc64c999cbd28b2ea4dbfd8a028ba66ef390c8de3a4a3
SSDEEP 192:/BFywW2hWXca8Lxyf7LRroihrSy2WVPwZNU6nq9bFs0X01k9z3AOA8DkI8:JfW2hWXcaGAf7pofyfOA9bFs0R9zNAO8
TLSH
T1EFA2298362BCA903E5575B30A2F9EB937D391BC32990B0665494B41438E37DAFE1963C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-convert-l1-1-0.dll
Size 26KB
SHA256 64c48b1280e4540c205ee7798b7da200afd95898d520ece1d56bf8a8a351fc3e
MD5 236d7460e5d69e0b366bc9536a4de45e
SHA1 1f093347533303aad6f1b7c5d232c30b23f69f71
SHA512 ed44c5097c831a1865078c6ded876929854b3cc01e8ea227cd1fb78df3f44070c8c7536cbe24223c5177e14322ab3580cde3bc5ed8aeddf29cdb1d480ef59091
SSDEEP 192:a9cyNW2hW+ca8LxydkeR+ysI0yQN+HTeQZNiBX01k9z3AIsPr/eanig:fyNW2hW+caGAPwdNQq/R9zZCr/9ig
TLSH
T19EC2E98366E87F55E59F177221FA9BD36A381B86159153B4C203D14C3883782BD97C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-environment-l1-1-0.dll
Size 22KB
SHA256 1a513c0601c5b628018c003d8598586d4a48fd1acf51372f6783dc23b0a27756
MD5 1affe1e2dd2a340a606e2ec7d3bfbb31
SHA1 f916344fcf71582cb84139931366107065cd9762
SHA512 0a372ca20f62197a62728b43e78f43e33fe44f5eef599e38ab4779b14beafc947e643485a4d6baa67c7ed2383f2fbba204340d0d3df60cef9e661d5cdfc5b8e5
SSDEEP 192:DW2hWsOca8LxydkeR+g5LKY8u27X01k9z3AxG1ms:DW2hWsOcaGA5xo7R9zqW
TLSH
T11DA229C25B786142FADB5E7092B4EA537D3CA7CB1D4095770AE6F2142CD3781AB2063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-filesystem-l1-1-0.dll
Size 22KB
SHA256 89bb192dd079784d9ba716a2e45a1ee6af75c67e9151fde77eb8ec32cb014182
MD5 cbe1b07d437d0f857b14ce71e19fe0c8
SHA1 4c9b8a63cdf9260298532bc5b546ef385e56b461
SHA512 d943dd486483d556dfc378e023c5760d887c2d08132f649428be646634f01995fa7643e9de5594fa995047e751b06a583d1570d7444283800505f42a995d6d51
SSDEEP 384:lN7nWm5C1W2hWRcaGAf7pofYhcSgnS+R9zn7uy:LnWm5CDkbdewTgSi9zKy
TLSH
T11AA22A8357E87E02EEAB1B7251FDDBD73E3D1B82099247629082A11839E33C0BF1546D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-heap-l1-1-0.dll
Size 22KB
SHA256 e5a0c8d551e36e5fd394a45a5e9229f592b46d8e80897f25e7f0ca449abb6b00
MD5 824274f2f049648f720ac3b101db27e1
SHA1 29c51fea85d7f166c1eba7d91f8d11f962853a2b
SHA512 c490a90c886452b8e95e15b515ecf0f211bbf1693d90e8702ea9edf55b4a1ade7c94cc5c3ef891762579497e470af4867000fec8f106cca455aeff9606d05a98
SSDEEP 192:YCh8Y17aFBRQW2hWVGca8LxydkeR+qSTdbV46X01k9z3A7EAc+LlSOPP9:LLNW2hWVGcaGAfS5FR9zeEA95SOPP9
TLSH
T1F1A25C8386B85402EE9B6F7062E9DA873D7DA7C36C50C9669197F1582CD33C4AB1063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-locale-l1-1-0.dll
Size 22KB
SHA256 f13dc1d6895f21fe2f7fd4b7ada78828b5a819013f751aa32eb1704beb4dc469
MD5 aac72a019b154dacb2a2709aab60eb49
SHA1 ffedf0cec8bc9192d6843f842f865b61552f48c5
SHA512 5785d853c63bf84063c544be8e4238b83634050b63ac5ec7ab2b001fa180111fbd21962912dcf5e2247fb892cb39cd3b87a575a881c80d2878cdb7c3e419f6e3
SSDEEP 192:ZTW2hWmlca8Lxyf7LRroihrSjs3bV46X01k9z3A7EAdRK1r:hW2hWecaGAf7pofjs3FR9zeEAS1
TLSH
T154A26CC787A8A403EA872EB091E9DB477C3C67C31D01D59A15C6F4582CA37DCEB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-math-l1-1-0.dll
Size 30KB
SHA256 a13aed9e8d7f4f53826cedd6acbc7b75dba51aeecd7f030b0f0d7b7c66e1a042
MD5 9256995809d5692537b9ad3cea7f1f14
SHA1 fe11173f04815f92423fd23442d93ccc3cfa8a23
SHA512 cd834dcdcb28cd1c15780866c42db3ba926b59518c669e6b2d3b92005412cf571aafa6afacc2141510c5167b1f2c9f11823e3fa3eec2f85fd7dc6df13f0b9efa
SSDEEP 384:p7yaFM4Oe59Ckb1hgmL5W2hWccaGAMlscmeR9zXUR:tFMq59Bb1jXbbw7N9zkR
TLSH
T1C7D2F9475ADCFF53D68F4BB301F08BCA69381FA264D1B6B4D84BA08834627C47E43A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-private-l1-1-0.dll
Size 74KB
SHA256 a573c8d83476655ed863aca9bc97c806b82bbcac03ce518906fa2458476de5f7
MD5 41d2db4f0d60db81c23864cb5387c8f3
SHA1 a0ac2126c2632eb5a0a4ad431d31e79da4f6fb79
SHA512 a39a4bc23d4d92a3ab7b71c83a39cba24cc2acdeebe06e54f263b6183f0eb9bff1e4328d01225dd3f759c64b7724c332dc06e3f92f5c849872692da96f67ac1a
SSDEEP 1536:pfQTZqDe5c4bFe2JyhcvxXWpD7d3334BkZnjPVTQz46Q:eZqDe5c4bFe2JyhcvxXWpD7d3334BkZp
TLSH
T14273F5DB49E63F21E58FF3B76BFB13C90B253A4418806274EAC7556B34853A9BC53A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-process-l1-1-0.dll
Size 22KB
SHA256 90d0c8e9ea6a4e82efcdc7ba522da3989316397218f3d1320eed1bab491c0938
MD5 2b05f6a42d0af9f4894fba4bee0f51df
SHA1 b8066ee2f6faa0b03129ff5c48bf2d482af62694
SHA512 82d92858938df3ccfee4b8fa0ae603a50975030c2cba49148c33291a163ea9baa785f9569d1e921cc6aac7a57bd91213820c561975db4f1dc847d9e5f6b6869b
SSDEEP 192:BeXrqjd7tW2hWmzca8Lxyf7LRroihrSi4CObV46X01k9z3A7EAKJDE/:B4r0W2hWocaGAf7pofiFOFR9zeEAb/
TLSH
T17DA22BCB97B46506E6675F7081F9C7833E3A97C76C50916A9591F00C3CA378AAB2052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-runtime-l1-1-0.dll
Size 26KB
SHA256 d893a0f2c1bf6247fb94393728c6293570090028d4dd30dcea01a01b0460b0c4
MD5 08c481821ff304b1b17dcfa16dba9b83
SHA1 2fc9606b99653bc695a5eb7b8544b5aaaf0b4593
SHA512 a1eac79a50220b16124eb8a4bcf3fbdef63cc39a271daefd33b570dad41694cfc6a9b71a0ef884cf5f89031bb5b4a80c5c782ede4d8a81222aa3536e0c54fc94
SSDEEP 384:Aysyr7XW2hWucaGAjrrcUthXBnR9z6IpflZ:P3r75lb/QCf9zNfb
TLSH
T1F3C2198756F87F03EA8B2F7316F9D7D72A3663872A509575C493E0883883784BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-stdio-l1-1-0.dll
Size 26KB
SHA256 456adaf7d2116f3e9410a0c1acd19f54bc9decc8e75b02f82c4a7d56c980e71f
MD5 92e4dadae9a9a0a2b96cfa9476772114
SHA1 6a0785c373dc2d691dc542ff19a5b7236fd1e819
SHA512 c5cf819193a220880c0d200fc62a9fc98afc85f5250a47130554e8dac67d81e61dfd7aca8488f6ecfbec37f1da8b6abe34d58368ee8990468bb1e4fe39ac4699
SSDEEP 384:3V2oFVhrW2hW8caGA13OGTYAsR9zCNEK7:3ZD/bpdMj9z6r7
TLSH
T1D2C2D68392E87E01E38B877369FAEBDA5734578328407579C543E58439C639D7D0316E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-string-l1-1-0.dll
Size 26KB
SHA256 8d360f373b21726d005df5d6e1e5d55f5aa83f6d9d6a055f4dc0331965671dba
MD5 b9bfbf196677d56b05fd0e7e069ee277
SHA1 4c7e5ec8414684d9bd0ae443f741e80cc21186ad
SHA512 d454c2bf246e7fc61adabe5d71b13f97cdb9a803cfe6d80212a4358ad8417546da4c1aa08fc34804e6659ac355e5aea6e312a7a13fc1b117427cb03eca52a9fa
SSDEEP 768:YCV5yguNvZ5VQgx3SbwA71IkFmQbq9zV6j:D5yguNvZ5VQgx3SbwA71I1QSzUj
TLSH
T18CC2E78347F83F51CACF5BB355FA8BC32A384B4615406375D463918C38827A6BE6BA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-time-l1-1-0.dll
Size 22KB
SHA256 c674ee45208477eec3669db64abb586df50d4fa38aa5b47ed2012d4bc5d9ec4e
MD5 c70f5907e0d9400f00705fd92c921406
SHA1 b4440d7e18afc8206d8ad33d1784ce42058c8fe2
SHA512 6341f5bc2ce3312979d810fee390c350922355952027b4f40028ed16a26c000989c1f3b7f5d87d28f2ac42b3cc4cc59b38d42b6bfbc3bdf747b4a492a9a2ac65
SSDEEP 192:8ChwDiW2hWskca8LxydkeR+1PmbdxP3NGmVX01k9z3AsHU:DW2hWskcaGAEuP3U0R9zjHU
TLSH
T12EA2198346E8BA0BFACF0B7252FDDBE73B3817C21AC0B5669152944435D3385BE2256C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\api-ms-win-crt-utility-l1-1-0.dll
Size 22KB
SHA256 7c31b21496d4783456d9093d0742e1727fe77e1ccb27d717c327039859561438
MD5 abbcf187c339d5e444f6cdd06268cbf3
SHA1 9654b885a6e193db38664b7ee3024d144075635d
SHA512 6d2d41282980df21d5b9bd5a4d0732378455b8708fdbf88c1a7340322c7b6c52a5280d09af9af06a4ec13824d627e3efe27a34bcc3a9f528ef042c94e5b9d37c
SSDEEP 384:7/fxW2hWncaGAf7pofccQBMscmeR9zXJH:7/fvqbdePQBM7N9zZH
TLSH
T1CBA24B938BB8A502E6DB6F7093E4DA837C3C5BC31D50966681D5F0482CA7B85FB3162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\base_library.zip
Size 1.4MB
SHA256 6c00492e10d1ae1bc5b529c6f3af232ff102d540f4e60d4e89747c5d1bbbcad5
MD5 43ab292d4701c3aed46145acf7a71b5a
SHA1 e443c0c75aff2732992ddd924e5767c7f21716cc
SHA512 bd83c1839c15d4521ea364fa85ad8ecd2d37335e776032c1f3b9add94bcf0eaa5905cb4454bd66cf7ca05d5ee376dd1b8ee7990576c1ba6c20cd8913e91e25f5
SSDEEP 24576:uafPWdmz53cnz/bucEvUFiYx/Ri3sQR5pLHHoTvgwjwhA:Ux/Ri8QR5piF
TLSH
T14E6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\pyexpat.pyd
Size 194KB
SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
MD5 79561bc9f70383f8ae073802a321adfb
SHA1 5f378f47888e5092598c20c56827419d9f480fa7
SHA512 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c
SSDEEP 6144:VK/lLDYZL1p13eiG7eDT9AmNfLVuOgOgOgOgOgOgNltwZSm:VglkZHLVuOgOgOgOgOgOgN0sm
TLSH
T131146C5BB1A2C0EBD8838038D6D34A0BDBB1B865039197CF52C4EB7D5F277523A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\python3.dll
Size 65KB
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
TLSH
T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\setuptools-65.5.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\sqlite3.dll
Size 1.5MB
SHA256 314bba62f4a1628b986afc94c09dc29cdaf08210eae469440fbf46bcdb86d3fd
MD5 89c2845bd090082406649f337c0cca62
SHA1 956736454f9c9e1e3d629c87d2c330f0a4443ae9
SHA512 1c467a7a3d325f0febb0c6a7f8f7ce49e4f9e3c4514e613352ef7705a338be5e448c351a47da2fb80bf5fc3d37dbd69e31c935e7ff58ead06b2155a893728a82
SSDEEP 24576:ozx+dvHgdXZW1s4gLLk56J0s3XyBh4mqWvqS/cm4ynZ3YSoXkMEKp:ApW1cd0s3CMmqWSS/ci3YSTk
TLSH
T118659C4BF2B801ADC0A7C1B9C91B570BEBB27405177497DB5594CA692F23FE217BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33402\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads