eb26c85c60590c7012dd4128e4f310ca6e009d0bc84138ea9969209abb298931

Analysis

max time kernel
10s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.9MB
Sample260922-2mf25sys5j
SHA256 eb26c85c60590c7012dd4128e4f310ca6e009d0bc84138ea9969209abb298931
MD5 0889d61a9afad5decb6e8b0858490c5b
SHA1 0d51a13fc070c511178dd6451479f63cd447c4b7
SHA512 06d4d0d10ff93fb36836a6d3200c906c0d15528d323082d23cf239dfc3a436c956a3c132c8745c487e20de88911f2c5a14a5e44083a3ccb389b7dab3039b90d3
SSDEEP 24576:Tunw9qbcKPwTeg3EkCpq+qWJIBuVdDExTL9+vgd7rnBgLyT/dKXVQGlGqeBRxB:Tuw9qbrWKXiBkExTsgdvnBT5KXmqib
TLSH
T11795F14082B415F5F17396F8C6FAAB0675707883BB2109D31A82D6EFD9B1CB0D8356A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3760	explorer.exe
3324	explorer.exe
5352	explorer.exe
4932	explorer.exe
5728	explorer.exe
3392	explorer.exe
4584	explorer.exe
2696	explorer.exe
1152	explorer.exe
4312	explorer.exe
1600	explorer.exe
2856	explorer.exe
2824	explorer.exe
4400	explorer.exe
4724	explorer.exe
2672	explorer.exe
4664	explorer.exe
4248	explorer.exe
2840	explorer.exe
1896	explorer.exe
2096	explorer.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2544	3328	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 3760 wrote to memory of 4256	3760	explorer.exe	91
PID 4256 wrote to memory of 5112	4256	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3324 wrote to memory of 4968	3324	explorer.exe	94
PID 4968 wrote to memory of 2580	4968	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 5352 wrote to memory of 1224	5352	explorer.exe	97
PID 1224 wrote to memory of 252	1224	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4932 wrote to memory of 5616	4932	explorer.exe	100
PID 5616 wrote to memory of 1640	5616	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 5728 wrote to memory of 1384	5728	explorer.exe	103
PID 1384 wrote to memory of 4316	1384	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 3392 wrote to memory of 2832	3392	explorer.exe	106
PID 2832 wrote to memory of 1936	2832	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	181
PID 4584 wrote to memory of 1456	4584	explorer.exe	109
PID 1456 wrote to memory of 5808	1456	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	110
PID 2696 wrote to memory of 5232	2696	explorer.exe	112
PID 5232 wrote to memory of 4880	5232	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	156
PID 1152 wrote to memory of 4860	1152	explorer.exe	115
PID 4860 wrote to memory of 2860	4860	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	116
PID 4312 wrote to memory of 1464	4312	explorer.exe	118
PID 1464 wrote to memory of 4512	1464	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	119
PID 1600 wrote to memory of 2308	1600	explorer.exe	121
PID 2308 wrote to memory of 5704	2308	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	122
PID 2856 wrote to memory of 4376	2856	explorer.exe	124
PID 4376 wrote to memory of 5592	4376	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	125
PID 2824 wrote to memory of 1984	2824	explorer.exe	127
PID 1984 wrote to memory of 4404	1984	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	128
PID 4400 wrote to memory of 4172	4400	explorer.exe	130
PID 4172 wrote to memory of 5104	4172	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	168
PID 4724 wrote to memory of 4112	4724	explorer.exe	133
PID 4112 wrote to memory of 5744	4112	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	134
PID 2672 wrote to memory of 3008	2672	explorer.exe	136
PID 3008 wrote to memory of 4100	3008	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	137
PID 4664 wrote to memory of 5336	4664	explorer.exe	139
PID 5336 wrote to memory of 2248	5336	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	207
PID 4248 wrote to memory of 1820	4248	explorer.exe	142
PID 1820 wrote to memory of 1448	1820	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	560
PID 2840 wrote to memory of 1052	2840	explorer.exe	145
PID 1052 wrote to memory of 3164	1052	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	146
PID 1896 wrote to memory of 4792	1896	explorer.exe	148
PID 4792 wrote to memory of 3796	4792	2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe	553

C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2096
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3888
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5140
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4812
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4880
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4644
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5584
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5828
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3188
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1400
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4760
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5104
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3080
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3576
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5620
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4116
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4684
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5932
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2276
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1936
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4600
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2588
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1800
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1396
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3400
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2716
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1780
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5624
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4272
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1444
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2212

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4564
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2408
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3588
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3928
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:460

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4608
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2536
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2248
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1500
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2472
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2504
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5996
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4320
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5488
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4416
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2600
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2488
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1480
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6148
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6216
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6268
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6336
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6452
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6500
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6540

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6568
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6616
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6684
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6736
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6804
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6852
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6920
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6968
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7008

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7036
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7084
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7152
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4672
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6188
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6332
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6496
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6512
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6632
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6660
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6780
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6884
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7004
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7108
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6176
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6200
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6416
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6600
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6540

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6676
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6860
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7096
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7124
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6308
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6548
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6756
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6908
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6972
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6556
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:256
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6864
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6168
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2560
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6892
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6916
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6996
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7176
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7244
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7292
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7360
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7408
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7476
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7532
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7604
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7652
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7720
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7768
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7836
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7892
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7960
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8012
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8080
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8132
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7208
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7296
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7352
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7468
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3904
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7680
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7708
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7816
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7924
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8016
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8064
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2544
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2240
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7436
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7464
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7672
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7772
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7928

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7876
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8068
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5096
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7316
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7452

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7224
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3284
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7796
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8028
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8052
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5936
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5400
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7952
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8152

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7432
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7592
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8112
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5680
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7936
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8196
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8264
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8312
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8380
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8428
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8496
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8544
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8612
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8660
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8728
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8776
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8844
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8892
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8960
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9008
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9076
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9124
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9192
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8256
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8344
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8456
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8468
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8604
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8668
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8808
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8916
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5492

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8940
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9016
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9160
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8208
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3800
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6596
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8576
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8704
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8792
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9040
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7064
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8220
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8444
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8580
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8912
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8952
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9120

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6868
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8360
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8956
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9004
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8308
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8548
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3980
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3584
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8560

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8716
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9072
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5016
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6768
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:704
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1808
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6760
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1436
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1704
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:952
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4612
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1300
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5072

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4560
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5992
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2896
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1620
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1476
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4396
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4304

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1136
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1140
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1240
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4480
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2808
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1672
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5188
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4308
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4528
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:992
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4816
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3972
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6044
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4708
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1340
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4104
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2192
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3136
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5484
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1848

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7908
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3316
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3024
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4848
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5984
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6032
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4524
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4428
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6140
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3620
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2652
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3456
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2280

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4900
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2480
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4080
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5656
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5044
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5160
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2396

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2012
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2316
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4140
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1208
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1076
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2784
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5340
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:416
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:424
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3000
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3796
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3428
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3628
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5144
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8872
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1448
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5384
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5300
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6256
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1236
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4244

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6340
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6492
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4940
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6692
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7560
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6816
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1844
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6840
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6956
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4092
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5176
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3092
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6272
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6604
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6436
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6648
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8292
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2212

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6876
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6932
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7076
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6380

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5872
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6360
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4364
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6248
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4936
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6644
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5592
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:788
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6964

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7020
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:108
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6740
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6172
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6424
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6764
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6280
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2368
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6484
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7280
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7148
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7524
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4648
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7732
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6752
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6448
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6276
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6620
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6516
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8096
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7376
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7328
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7060
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7608
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6400
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5740
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7712

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5316
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5476
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7980
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8020
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5852
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3224
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7180

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6544
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7556
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2920
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7028
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6532
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8160
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7852
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8000
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8088
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6528
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7396

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5240
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1060
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7804
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7676
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4268
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3852
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:980
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7860
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8288
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4332
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8396
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7536
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8532
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7392
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8616
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7760
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8856
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8864
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8980
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7976
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9116
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7364
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7180

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6936
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7452
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8460
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8748
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7232
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8164
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2152

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7808
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9088
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9024
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7300
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8024
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8364
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8296
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6716
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8072

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8464
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8896
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9032
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8200
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8056
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8476
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5492
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8224
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8340

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8656
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8820
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8900
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6848
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7440
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9064
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1996
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7072
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8368
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3100
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8664
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1964
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8452
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:956
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3368
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8232
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4712
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7272
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1688
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4928
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6012
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5732
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7196
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:9068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8920
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6800
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4748

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8936
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6504
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1560

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7912
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6328
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2748

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7188
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:9068
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4540
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2732
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2360
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7756
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4872
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5880
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5132
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2576
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3824
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8180
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4744
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4992
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:720
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8116
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6612
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7516
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2388
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1828
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1328
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5100
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3668
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4884
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3868
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7512
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:7632
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1452
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3212
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5664
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:8584
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4788
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4768
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3944

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7140
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:240
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7276
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5320
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:5564

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4088
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2128
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4620
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2608
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:3164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2320
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5564
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:7812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2452
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:4276
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2740
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3164
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:2028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3356
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:3960
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:4264

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3076
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:5968
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:6588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1640
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:6712
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3020
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:1164
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:8860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1868
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2028
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads