65d17e81fdb9cbcf10c26ac9717cb4378c801745bfd192de5203236c414cf8a9

Analysis

max time kernel
109s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Size 130.6MB
Sample260823-2cd5ss1cmc
SHA256 65d17e81fdb9cbcf10c26ac9717cb4378c801745bfd192de5203236c414cf8a9
MD5 c1bae372dc3bdb13078c2a7ab5ebcdd0
SHA1 5e072d62d75872b6a22092abd79f7cb5e8310e84
SHA512 3b6ecd6f38a9bede2ccf2b2f3ec622b722a9b5b306c49fdefd80e02449f5b658e9842a624c139f57c6219db3af7a17d7cdbf58a3287249ac41b37275521c506c
SSDEEP 786432:a0LoCOn+2Ns4urYDNulLBiuV05/YwlAKVRl8a/pLNN1TVAB1JSvjKA6B8fOjpSbs:aMoCm/NXwAMT8fepSC72SjTFK7TeP
TLSH
T14E68AE16B3E40652E56BC278C6978103E3B2B4571731D7CF305CD2582FABBE0AA7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4800	1744	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	88
PID 1744 wrote to memory of 2516	1744	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	89
PID 4800 wrote to memory of 5844	4800	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	90
PID 4800 wrote to memory of 5716	4800	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	91
PID 5716 wrote to memory of 1188	5716	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	93
PID 5716 wrote to memory of 128	5716	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	94
PID 2516 wrote to memory of 1620	2516	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	95
PID 5844 wrote to memory of 3536	5844	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	96
PID 5844 wrote to memory of 1916	5844	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	97
PID 2516 wrote to memory of 1080	2516	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	98
PID 128 wrote to memory of 428	128	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	99
PID 1916 wrote to memory of 1184	1916	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	100
PID 3536 wrote to memory of 1420	3536	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	101
PID 128 wrote to memory of 2856	128	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	102
PID 1916 wrote to memory of 2972	1916	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	103
PID 1080 wrote to memory of 3040	1080	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	104
PID 3536 wrote to memory of 4544	3536	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	105
PID 1080 wrote to memory of 3552	1080	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	106
PID 1188 wrote to memory of 1144	1188	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	107
PID 1188 wrote to memory of 3460	1188	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	108
PID 2856 wrote to memory of 2568	2856	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	109
PID 2972 wrote to memory of 1308	2972	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	110
PID 4544 wrote to memory of 4132	4544	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	111
PID 2856 wrote to memory of 1096	2856	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	112
PID 3552 wrote to memory of 5624	3552	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	113
PID 3040 wrote to memory of 4520	3040	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	114
PID 2972 wrote to memory of 1624	2972	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	115
PID 4544 wrote to memory of 5368	4544	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	116
PID 3552 wrote to memory of 4264	3552	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	117
PID 3040 wrote to memory of 4820	3040	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	118
PID 1620 wrote to memory of 2332	1620	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	119
PID 1420 wrote to memory of 2652	1420	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	120
PID 1184 wrote to memory of 5736	1184	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	121
PID 1420 wrote to memory of 5940	1420	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	123
PID 1620 wrote to memory of 2428	1620	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	124
PID 1184 wrote to memory of 940	1184	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	122
PID 3460 wrote to memory of 992	3460	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	125
PID 428 wrote to memory of 3480	428	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	126
PID 3460 wrote to memory of 4752	3460	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	127
PID 428 wrote to memory of 5052	428	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	128
PID 1624 wrote to memory of 2648	1624	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	129
PID 4820 wrote to memory of 3624	4820	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	130
PID 4264 wrote to memory of 5668	4264	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	131
PID 1624 wrote to memory of 5768	1624	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	132
PID 5368 wrote to memory of 3768	5368	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	133
PID 4264 wrote to memory of 1040	4264	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	134
PID 4820 wrote to memory of 4736	4820	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	135
PID 5368 wrote to memory of 2928	5368	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	136
PID 5940 wrote to memory of 2596	5940	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	137
PID 940 wrote to memory of 4116	940	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	138
PID 1308 wrote to memory of 5796	1308	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	141
PID 4752 wrote to memory of 4340	4752	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	139
PID 4132 wrote to memory of 5712	4132	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	140
PID 5940 wrote to memory of 1480	5940	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	142
PID 5624 wrote to memory of 5280	5624	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	144
PID 4520 wrote to memory of 4304	4520	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	143
PID 940 wrote to memory of 4532	940	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	146
PID 2428 wrote to memory of 2772	2428	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	147
PID 2332 wrote to memory of 2112	2332	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	145
PID 1308 wrote to memory of 1460	1308	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	148
PID 4752 wrote to memory of 4480	4752	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	149
PID 4132 wrote to memory of 4656	4132	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	150
PID 5624 wrote to memory of 3232	5624	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	151
PID 4520 wrote to memory of 3440	4520	2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        9⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        9⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        9⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        9⤵
        
        PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        9⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        9⤵
        
        PID:5180
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:128
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2684
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        
        PID:800
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:2148
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c1bae372dc3bdb13078c2a7ab5ebcdd0_akira_avaddon_cobalt-strike_coinminer_elex_glassworm_ice.exe"
        8⤵
        
        PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads