3d350f0580a9421acb96fafb79223b41a931e663e461eba999fded99ce2f191f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 7.4MB
Sample260905-nz2bysbn91
SHA256 3d350f0580a9421acb96fafb79223b41a931e663e461eba999fded99ce2f191f
MD5 4a45abd839ddcdeab22daaba26647dcb
SHA1 093c73fc78ce34d55a883f06d36410a7dd4e76de
SHA512 98d757464720fab92b7515b04c1a5777ea317bd6164283fe742333d1b9988d81776d82c1a575c08b8e39e579f758f029cad5aec79e379226a263df85bcd93f4a
SSDEEP 98304:YYg8+UhnuaZsKluZhCMYkc/Gbt5FkOwSrIcUsLXRL2wbup8F8g6XwnTswmOnO:IR6uoVurHQ4P/XRLF82nTswmOnO
TLSH
T10B7633A897A405F7FDF6E33D9AA1C8B2C665BC121711C59383F098A22D637C0663B753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2868	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2868	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2868	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2868	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4208	5060	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	86
PID 4208 wrote to memory of 2180	4208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	87
PID 2180 wrote to memory of 4576	2180	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 4576 wrote to memory of 1528	4576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 1528 wrote to memory of 3980	1528	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3980 wrote to memory of 4732	3980	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 4732 wrote to memory of 2868	4732	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 2868 wrote to memory of 1700	2868	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	93
PID 1700 wrote to memory of 1484	1700	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	94
PID 1484 wrote to memory of 972	1484	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	95
PID 972 wrote to memory of 4644	972	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 4644 wrote to memory of 1748	4644	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 1748 wrote to memory of 1028	1748	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	98
PID 1028 wrote to memory of 2880	1028	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 2880 wrote to memory of 2352	2880	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 2352 wrote to memory of 3584	2352	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	101
PID 3584 wrote to memory of 2780	3584	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	102
PID 2780 wrote to memory of 1288	2780	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	103
PID 1288 wrote to memory of 2300	1288	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	104
PID 2300 wrote to memory of 4868	2300	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 4868 wrote to memory of 1216	4868	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	106
PID 1216 wrote to memory of 1348	1216	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	107
PID 1348 wrote to memory of 1236	1348	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	108
PID 1236 wrote to memory of 4788	1236	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	109
PID 4788 wrote to memory of 4408	4788	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	110
PID 4408 wrote to memory of 1096	4408	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	111
PID 1096 wrote to memory of 3700	1096	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	112
PID 3700 wrote to memory of 3192	3700	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	113
PID 3192 wrote to memory of 2896	3192	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	114
PID 2896 wrote to memory of 3668	2896	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	115
PID 3668 wrote to memory of 4832	3668	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	116
PID 4832 wrote to memory of 4364	4832	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	117
PID 4364 wrote to memory of 1232	4364	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	118
PID 1232 wrote to memory of 5016	1232	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	119
PID 5016 wrote to memory of 552	5016	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	120
PID 552 wrote to memory of 208	552	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	121
PID 208 wrote to memory of 1204	208	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	122
PID 1204 wrote to memory of 2084	1204	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	123
PID 2084 wrote to memory of 4796	2084	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	125
PID 4796 wrote to memory of 1444	4796	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	126
PID 1444 wrote to memory of 3360	1444	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	127
PID 3360 wrote to memory of 3156	3360	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	128
PID 3156 wrote to memory of 888	3156	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	129
PID 888 wrote to memory of 4124	888	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	130
PID 4124 wrote to memory of 436	4124	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	131
PID 436 wrote to memory of 2536	436	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	132
PID 2536 wrote to memory of 3328	2536	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 3328 wrote to memory of 5068	3328	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	134
PID 5068 wrote to memory of 4700	5068	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	135
PID 4700 wrote to memory of 740	4700	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	138
PID 740 wrote to memory of 1928	740	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	139
PID 1928 wrote to memory of 3232	1928	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	140
PID 3232 wrote to memory of 1576	3232	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	141
PID 1576 wrote to memory of 948	1576	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	142
PID 948 wrote to memory of 644	948	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	143
PID 644 wrote to memory of 1452	644	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	144
PID 1452 wrote to memory of 5008	1452	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 5008 wrote to memory of 1756	5008	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	147
PID 1756 wrote to memory of 1940	1756	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	149
PID 1940 wrote to memory of 4456	1940	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	150
PID 4456 wrote to memory of 3424	4456	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	151
PID 3424 wrote to memory of 4988	3424	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	152
PID 4988 wrote to memory of 1388	4988	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	153
PID 1388 wrote to memory of 3908	1388	2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        7⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        33⤵
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        35⤵
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        37⤵
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        39⤵
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        41⤵
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        43⤵
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        45⤵
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        46⤵
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        47⤵
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        48⤵
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        49⤵
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        50⤵
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        51⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        52⤵
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        53⤵
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        54⤵
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        55⤵
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        56⤵
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        57⤵
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        58⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        59⤵
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        60⤵
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        61⤵
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        62⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        63⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        64⤵
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        65⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        66⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        67⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        68⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        69⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        70⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        71⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        72⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        73⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        74⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        75⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        76⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        77⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        78⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        79⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        80⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        81⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        82⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        83⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        84⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        85⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        86⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        87⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        88⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        89⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        90⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        91⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        92⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        93⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        94⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        95⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        96⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        97⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        98⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        99⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        100⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        101⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        102⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        103⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        104⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        105⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        106⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        107⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        108⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        109⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        110⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        111⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        112⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        113⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        114⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        115⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        116⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        117⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        118⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        119⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        120⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        121⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        122⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        123⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        124⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        125⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        126⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        127⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        128⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        129⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        130⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        131⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        132⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        133⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        134⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        135⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        136⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        137⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        138⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        139⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        140⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        141⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        142⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        143⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        144⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        145⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        146⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        147⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        148⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        149⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        150⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        151⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        152⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        153⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        154⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        155⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        156⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        157⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        158⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        159⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        160⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        161⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        162⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        163⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        164⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        165⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        166⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        167⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        168⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        169⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        170⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        171⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        172⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        173⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        174⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        175⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        176⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        177⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        178⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        179⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        180⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        181⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        182⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        183⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        184⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        185⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        186⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        187⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        188⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        189⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        190⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        191⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        192⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        193⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        194⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        195⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        196⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        197⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        198⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        199⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        200⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        201⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        202⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        203⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        204⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        205⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        206⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        207⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        208⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        209⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        210⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        211⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        212⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        213⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        214⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        215⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        216⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        217⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        218⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        219⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        220⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        221⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        222⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        223⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        224⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        225⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a45abd839ddcdeab22daaba26647dcb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe -m pip install pypiwin32
        226⤵
        
        PID:7288
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7288 -s 244
        227⤵
        
        PID:7360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\base_library.zip
Size 1.3MB
SHA256 602457961db9b999059135ddf5c102a4ad51e6cbd4c242f966b23632c1d181f8
MD5 cf10a6a68209ccb2be49e2bbf1b738e9
SHA1 103fd5e7ed2c27ac780e423ad3448f23970dd7cc
SHA512 672766ad577a4d3bc161eb5c8e837671f7d5300724485e9653c31d7cc4f02298fac99f7616c984c3c9b46fe57242801ce8aa1d878c24e94970a0e87cb5015e55
SSDEEP 12288:Si2W7Wpr/djdTji2cPPdxhYx6RpGcuOBa80201jwCVRDVoioSYBVwU7603yCXWf1:f7Wpr/dZj5cPPdxhY4zVFnYSeT11Ak
TLSH
T15D551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50602\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads