6e42c5d2039cc06f160f72d24039d58c4e4bc9d5744a45d18449fb2ccf3369d2

Analysis

max time kernel
85s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 72.4MB
Sample260719-2fd9zagz91
SHA256 6e42c5d2039cc06f160f72d24039d58c4e4bc9d5744a45d18449fb2ccf3369d2
MD5 5cf05452d8abd32877f87f0c4e3a2059
SHA1 68f6876b5fd914f3f67ece5b08504a31bcd3f4fe
SHA512 5ea0212988a3a1d89b255004c44176b0fef252af9fdd584c1c4f23c18c284f2fa4c73abe4669363f53a2c1d575b24847db5fc80f60a5a20ac112d5384796e8a1
SSDEEP 1572864:D9zxVra7KZq+dy2J0f0/rBdsG7bpip0WWBW+eH3+BDO0mu90Nkcef:D9na7KYI5BB7tE0WFHUt90NkJf
TLSH
T1E5F733C0C6850196EE5A673140738D7B6627BFBDAEB9818D955DB037BF771C28838823
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3336	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2404	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2908	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5936	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1520	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1728	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6112	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1896	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2728	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1960	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5488	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1676	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2540	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4116	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1968	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4768	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5144	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4772	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5508	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3492	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4644	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2072	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5728	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5308	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1876	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1456	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5100	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1592	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4072	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2924	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5992	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	6116	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3428	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2656	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5748	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4648	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1704	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1364	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4320	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5912	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4588	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2688	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3476	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1132	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2400	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5660	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5448	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1368	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4084	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3452	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5400	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2684	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5040	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2660	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4888	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4100	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	1064	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4328	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3696	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	5588	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	3900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 6052	4288	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 6052 wrote to memory of 2900	6052	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 2900 wrote to memory of 680	2900	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 680 wrote to memory of 3336	680	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 3336 wrote to memory of 2404	3336	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 2404 wrote to memory of 2908	2404	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 2908 wrote to memory of 5936	2908	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 5936 wrote to memory of 1520	5936	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 1520 wrote to memory of 1728	1520	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 1728 wrote to memory of 6112	1728	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 6112 wrote to memory of 1896	6112	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 1896 wrote to memory of 2728	1896	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 2728 wrote to memory of 1960	2728	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 1960 wrote to memory of 5488	1960	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 5488 wrote to memory of 1676	5488	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 1676 wrote to memory of 2540	1676	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 2540 wrote to memory of 4116	2540	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 4116 wrote to memory of 1968	4116	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 1968 wrote to memory of 4768	1968	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 4768 wrote to memory of 5144	4768	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 5144 wrote to memory of 4772	5144	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 4772 wrote to memory of 5508	4772	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 5508 wrote to memory of 3492	5508	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 3492 wrote to memory of 4644	3492	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 4644 wrote to memory of 2072	4644	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 2072 wrote to memory of 5728	2072	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 5728 wrote to memory of 5308	5728	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 5308 wrote to memory of 1876	5308	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 1876 wrote to memory of 1456	1876	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 1456 wrote to memory of 5100	1456	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 5100 wrote to memory of 1592	5100	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 1592 wrote to memory of 4072	1592	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 4072 wrote to memory of 2924	4072	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 2924 wrote to memory of 5992	2924	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 5992 wrote to memory of 6116	5992	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 6116 wrote to memory of 3428	6116	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 3428 wrote to memory of 2656	3428	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 2656 wrote to memory of 5748	2656	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	127
PID 5748 wrote to memory of 4648	5748	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 4648 wrote to memory of 1704	4648	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 1704 wrote to memory of 1364	1704	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	130
PID 1364 wrote to memory of 4320	1364	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 4320 wrote to memory of 5912	4320	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 5912 wrote to memory of 4588	5912	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 4588 wrote to memory of 2688	4588	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 2688 wrote to memory of 3476	2688	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 3476 wrote to memory of 1132	3476	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	136
PID 1132 wrote to memory of 2400	1132	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 2400 wrote to memory of 5660	2400	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	138
PID 5660 wrote to memory of 5448	5660	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	139
PID 5448 wrote to memory of 1368	5448	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 1368 wrote to memory of 4084	1368	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	141
PID 4084 wrote to memory of 3452	4084	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	142
PID 3452 wrote to memory of 5400	3452	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 5400 wrote to memory of 2684	5400	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	145
PID 2684 wrote to memory of 5040	2684	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 5040 wrote to memory of 2660	5040	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	147
PID 2660 wrote to memory of 4888	2660	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	148
PID 4888 wrote to memory of 4100	4888	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 4100 wrote to memory of 1064	4100	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	150
PID 1064 wrote to memory of 4328	1064	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	151
PID 4328 wrote to memory of 3696	4328	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 3696 wrote to memory of 5588	3696	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	153
PID 5588 wrote to memory of 3900	5588	2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
    3⤵
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
      4⤵
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        6⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        8⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        10⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        12⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        14⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        16⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        18⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        20⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        22⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        23⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        24⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        25⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        26⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        27⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        28⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        29⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        30⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        31⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        32⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        33⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        34⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        35⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        36⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        37⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        38⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        39⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        40⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        41⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        42⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        43⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        44⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        45⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        46⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        47⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        48⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        49⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        50⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        51⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        52⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        53⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        54⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        55⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        56⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        57⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        58⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        59⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        60⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        61⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        62⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        63⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        64⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        65⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        66⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        67⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        68⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        69⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        70⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        71⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        72⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        73⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        74⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        75⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        76⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        77⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        78⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        79⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        80⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        81⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        82⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        83⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        84⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        85⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        86⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        87⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        88⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        89⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        90⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        91⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        92⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        93⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        94⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        95⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        96⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        97⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        98⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        99⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        100⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        101⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        102⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        103⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        104⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        105⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        106⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        107⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        108⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        109⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        110⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        111⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        112⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        113⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        114⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        115⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        116⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        117⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        118⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        119⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        120⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        121⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        122⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        123⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        124⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        125⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        126⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        127⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        128⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        129⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        130⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        131⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        132⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        133⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        134⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        135⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        136⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        137⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        138⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        139⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        140⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        141⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        142⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        143⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        144⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        145⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        146⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        147⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        148⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        149⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        150⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        151⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        152⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        153⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        154⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        155⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        156⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        157⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        158⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        159⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        160⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        161⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        162⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        163⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        164⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        165⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        166⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        167⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        168⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        169⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        170⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        171⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        172⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        173⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        174⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        175⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        176⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        177⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        178⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        179⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        180⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        181⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        182⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        183⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        184⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        185⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        186⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        187⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        188⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        189⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        190⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        191⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        192⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        193⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        194⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        195⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        196⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        197⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        198⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        199⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        200⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        201⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        202⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        203⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        204⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        205⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        206⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        207⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        208⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        209⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        210⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        211⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        212⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        213⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        214⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        215⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        216⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        217⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        218⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        219⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        220⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        221⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        222⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        223⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        224⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        225⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        226⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        227⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        228⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        229⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        230⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        231⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        232⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        233⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        234⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        235⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        236⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        237⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        238⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        239⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        240⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        241⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        242⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        243⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        244⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        245⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        246⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        247⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        248⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        249⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        250⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        251⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        252⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        253⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        254⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        255⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        256⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        257⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        258⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        259⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        260⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        261⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        262⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        263⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        264⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        265⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        266⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        267⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        268⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        269⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        270⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        271⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        272⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        273⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        274⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        275⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        276⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        277⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        278⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        279⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        280⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        281⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        282⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        283⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        284⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        285⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        286⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        287⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        288⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        289⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        290⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        291⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        292⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        293⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        294⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        295⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        296⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        297⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        298⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        299⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        300⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        301⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        302⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        303⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        304⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        305⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        306⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        307⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        308⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        309⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        310⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-19_5cf05452d8abd32877f87f0c4e3a2059_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install --quiet Pillow
        311⤵
        
        PID:5760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Windows\Temp\_MEI42882\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Windows\Temp\_MEI42882\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
TLSH
T11E839D93E76665B5F46B82BA99C10323E730FD150350939FB384831B2F22F927D6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Windows\Temp\_MEI42882\_ctypes.pyd
Size 122KB
SHA256 543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
MD5 452305c8c5fda12f082834c3120db10a
SHA1 9bab7b3fd85b3c0f2bedc3c5adb68b2579daa6e7
SHA512 3d52afdbc8da74262475abc8f81415a0c368be70dbf5b2bd87c9c29ca3d14c44770a5b8b2e7c082f3ece0fd2ba1f98348a04b106a48d479fa6bd062712be8f7c
SSDEEP 3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
TLSH
T14AC36C17339410AAEBA34179C4732E07D7B1B45B1B2097CF02A4C6AA2F637936D6F752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Windows\Temp\_MEI42882\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
TLSH
T108537C05A69540A8D96781B9C8A35F57F9F2F1011B109BEF0368C18D2F237C3A6FB766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Windows\Temp\_MEI42882\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
TLSH
T142F33A92A394F4D5F7628C78D6624F17E7F678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Windows\Temp\_MEI42882\_queue.pyd
Size 31KB
SHA256 d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
MD5 5aa4b057ba2331eed6b4b30f4b3e0d52
SHA1 6b9db113c2882743984c3d8b70ec49fc4a136c23
SHA512 aa5aa3285ea5c177eca055949c5f550dbd2d2699202a29efe2077213cbc95fff2a36d99eecce249ac04d95baf149b3d8c557a67fc39ead3229f0b329e83447b7
SSDEEP 768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
TLSH
T13DE28E83AA946C9AC423C47194D66E35F971B7525700C7EF3318C25E1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Windows\Temp\_MEI42882\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
TLSH
T1F1834911A69050FAEBB3C0B6C1675E23FBB4B4C01390938F1156C66A5F33782BE7DA91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Windows\Temp\_MEI42882\_ssl.pyd
Size 173KB
SHA256 2b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
MD5 6774d6fb8b9e7025254148dc32c49f47
SHA1 212e232da95ec8473eb0304cf89a5baf29020137
SHA512 5d9247dce96599160045962af86fc9e5439f66a7e8d15d1d00726ec1b3b49d9dd172d667380d644d05cb18e45a5419c2594b4bcf5a16ea01542ae4d7d9a05c6e
SSDEEP 3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
TLSH
T116047C47B6942DB7D813E4FAC1230913DBB1F015331257DE49D5D64A0F07B0AADAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Windows\Temp\_MEI42882\_uuid.pyd
Size 24KB
SHA256 d462f34aca50d1f37b9ea03036c881ee4452e1fd37e1b303cd6daaecc53e260e
MD5 b9e2ab3d934221a25f2ad0a8c2247f94
SHA1 af792b19b81c1d90d570bdfedbd5789bdf8b9e0c
SHA512 9a278bfe339f3cfbd02a1bb177c3bc7a7ce36eb5b4fadaaee590834ad4d29cbe91c8c4c843263d91296500c5536df6ac98c96f59f31676cecdccf93237942a72
SSDEEP 384:ifo/nEW0bkiAQtIpZw8NHQIYiSy1pCQhPaGAM+o/8E9VF0Nysk5:iwnEqHQtIpZwO5YiSyvQGAMxkEH
TLSH
T15EB27C46DA601C54DD278AB1A4E54E2AE971FB824B50C3DB330CC1590F613C37AFA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Windows\Temp\_MEI42882\_wmi.pyd
Size 35KB
SHA256 0342916a60a7b39bbd5753d85e1c12a4d6f990499753d467018b21cefa49cf32
MD5 cb0564bc74258cb1320c606917ce5a71
SHA1 5b2bfc0d997cc5b7d985bfadddbfc180cb01f7cf
SHA512 43f3afa9801fcf5574a30f4d3e7ae6aff65c7716462f9aba5bc8055887a44bf38fba121639d8b31427e738752fe3b085d1d924de2633f4c042433e1960023f38
SSDEEP 768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
TLSH
T109F27E56E7641844ED37C6B998D64E1FE672B6468710C3CF3358C25A0F223C2BEBA364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd

Path C:\Windows\Temp\_MEI42882\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
Size 222KB
SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
MD5 d66f0edb0e1bea4403c1f38fe554a620
SHA1 3bfd2dee7da0d0641ed370e592c964e67252bbd3
SHA512 f3a535e31fb9e5bbaa7575eef02d79029e067f24fcde0548b8fd185290fed7c09b67f5dc7034186f3345b23d8a53efadac7fac5a01d98ae03d9452a31e6eaff5
SSDEEP 6144:ifUDesVRGeIiW1mrnHGGaxkP8VXaVlaz8fnt4HtFmiGJ/MIOM+033X+:KxsV8gW14G6le
TLSH
T14E24193662840066ED735275CC63A123DAF2B1610732A6CF05E0C7A55F2BFDAB6FDA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Windows\Temp\_MEI42882\base_library.zip
Size 1.3MB
SHA256 3ce1286af8dc2f63b2c6e49f36b48d7f17f42d29ac1addcf7974013251a4a877
MD5 82be8a72771f30209da690af8a0e640d
SHA1 4e51f9e2ac01977c37aeb0b86633d001d448936b
SHA512 f39799207a823a29ffa7e07ada72b5cb9418799e9de1bfe4c2a7a88f252eb91666ba7a1cbf5c94612711a367ee3414ede59ac175ee23ee44f76acb92e8d76383
SSDEEP 12288:tjhaYcm1dqHtzJYTq+zYgEkA1qJuABqYndgbcttcY+bkgCsHKPbdm3OmgRdTV7B4:t9aYcoqtJZFgttcY+wAKPbdm3HCT7B4
TLSH
T1FA55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp312-win_amd64.pyd

Path C:\Windows\Temp\_MEI42882\charset_normalizer\cd.cp312-win_amd64.pyd
Size 10KB
SHA256 be1d8801c9785a52e5bc1b0c77ceca2c88041a5d9b9bac7162d767f712ea10e3
MD5 baf53803e705ad4208c93426be81071a
SHA1 c40eadb8fd83a07f7786b3d16b1f70c0876a9bb5
SHA512 f4e4a6ed825d83fdf2dd7a4258fc2e57dee4ca5fe5e873bde2075107dd8675e257106b895eaf9f86d31a512ba30ba965aa03476b0f45c368fa9fb9798edd555e
SSDEEP 192:nJD0eIaQYVYZuLnN6KxvecRo930aeG1TbWVcS9H7EuO5:7kYVVLN6Kxxo93MmEcSZ4l
TLSH
T18E22F74CFA558CF6EA250239C9A74F1E72B5BA25178237CF4370C12E1EE3BE65279580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Windows\Temp\_MEI42882\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Windows\Temp\_MEI42882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Windows\Temp\_MEI42882\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Windows\Temp\_MEI42882\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_portaudio.cp312-win_amd64.pyd

Path C:\Windows\Temp\_MEI42882\pyaudio\_portaudio.cp312-win_amd64.pyd
Size 294KB
SHA256 68a0a2aae8097aa20bf7e9b403a37829db9f00d9feb0dd5e6b7dc2e7fbcd7819
MD5 a7d01fcc8a52d8833f0fc8a1abaffc61
SHA1 09249e6e0fdea1dc5acf9785fec376c1f2f561cd
SHA512 4bd174b8a5fe054aa447f5c9dcbb0fbdd48b1ca6a4a8db78d885a5d031147d84be92fa74a077c8ae3879cf5e53bea71f5759f82ec5863f05faf377b122fd0d0e
SSDEEP 6144:qFv0FdC3BipuH6BiZETQHTBsPvoWjnOXYWP:qFvzBi+ZEuafno
TLSH
T18B548D46F3A414F9D567813CCA979606E7F274500364DAEF17A0C6293F23BE1A93EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Windows\Temp\_MEI42882\python3.DLL
Size 66KB
SHA256 a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
MD5 4038af0427bce296ca8f3e98591e0723
SHA1 b2975225721959d87996454d049e6d878994cbf2
SHA512 db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3
SSDEEP 768:/BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM8:pDmF61JFn+/OJBIpL0j7Sy5xH
TLSH
T10E637152BB54F8A3DBFA65FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Windows\Temp\_MEI42882\python312.dll
Size 6.7MB
SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
MD5 48ebfefa21b480a9b0dbfc3364e1d066
SHA1 b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA512 4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
SSDEEP 98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
TLSH
T1C5665B127258C0AAD967A0B4CC23C6CEE7B1BC51BF50530B30AAB35E2F73796465E785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Windows\Temp\_MEI42882\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
TLSH
T154D28E576B642C49D823C9B2A4D28E26E931B6565710C2CF3368C15D1F327C37BBB369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Windows\Temp\_MEI42882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Windows\Temp\_MEI42882\unicodedata.pyd
Size 1.1MB
SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
MD5 fc47b9e23ddf2c128e3569a622868dbe
SHA1 2814643b70847b496cbda990f6442d8ff4f0cb09
SHA512 7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
TLSH
T1E6354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads