c567f2b67d485fe319a9599b6a7a80d9d24e2646dc8bf6457b4e2b839a0d79a3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Size 3.9MB
Sample260823-qhrgjaxbme
SHA256 c567f2b67d485fe319a9599b6a7a80d9d24e2646dc8bf6457b4e2b839a0d79a3
MD5 0665dea4dcaa7eab82b14b46feb7387e
SHA1 ca53dc5b050ee4b5775ed41ccb85bbc893852b25
SHA512 dbb8f8b7691663c46ae081aa83268a1b776b36ddab83b298e60ef317a8dc32340c9ff6ffaea3207c6c0933769dc9929e96d10642f869394275922891833b7c58
SSDEEP 49152:F0ktHFMh6zvqnvs0+v+O57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTP7c+DNE/l6RROQ+
TLSH
T161168D60FDDB50F9EA03183145ABA27FA33467195335CBC7C7401E9AE86BAE15D33229
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3932	HCCa6UDmScEjiHiAbQ.exe
2436	HCCa6UDmScEjiHiAbQ.exe
1512	HCCa6UDmScEjiHiAbQ.exe
3132	HCCa6UDmScEjiHiAbQ.exe
5068	HCCa6UDmScEjiHiAbQ.exe
1464	HCCa6UDmScEjiHiAbQ.exe
2416	HCCa6UDmScEjiHiAbQ.exe
4904	HCCa6UDmScEjiHiAbQ.exe
1224	HCCa6UDmScEjiHiAbQ.exe
4960	HCCa6UDmScEjiHiAbQ.exe
3060	HCCa6UDmScEjiHiAbQ.exe
3152	HCCa6UDmScEjiHiAbQ.exe
2124	HCCa6UDmScEjiHiAbQ.exe
3076	HCCa6UDmScEjiHiAbQ.exe
1676	HCCa6UDmScEjiHiAbQ.exe
1404	HCCa6UDmScEjiHiAbQ.exe
4948	HCCa6UDmScEjiHiAbQ.exe
2560	HCCa6UDmScEjiHiAbQ.exe
4276	HCCa6UDmScEjiHiAbQ.exe
4860	HCCa6UDmScEjiHiAbQ.exe
1636	HCCa6UDmScEjiHiAbQ.exe
4292	HCCa6UDmScEjiHiAbQ.exe
4796	HCCa6UDmScEjiHiAbQ.exe
5148	HCCa6UDmScEjiHiAbQ.exe
5256	HCCa6UDmScEjiHiAbQ.exe
5356	HCCa6UDmScEjiHiAbQ.exe
5456	HCCa6UDmScEjiHiAbQ.exe
5556	HCCa6UDmScEjiHiAbQ.exe
5624	HCCa6UDmScEjiHiAbQ.exe
5752	HCCa6UDmScEjiHiAbQ.exe
5856	HCCa6UDmScEjiHiAbQ.exe
5924	HCCa6UDmScEjiHiAbQ.exe
6052	HCCa6UDmScEjiHiAbQ.exe
1808	HCCa6UDmScEjiHiAbQ.exe
2388	HCCa6UDmScEjiHiAbQ.exe
3232	HCCa6UDmScEjiHiAbQ.exe
5312	HCCa6UDmScEjiHiAbQ.exe
5488	HCCa6UDmScEjiHiAbQ.exe
5804	HCCa6UDmScEjiHiAbQ.exe
6212	HCCa6UDmScEjiHiAbQ.exe
6280	HCCa6UDmScEjiHiAbQ.exe
6408	HCCa6UDmScEjiHiAbQ.exe
6512	HCCa6UDmScEjiHiAbQ.exe
6580	HCCa6UDmScEjiHiAbQ.exe
6708	HCCa6UDmScEjiHiAbQ.exe
6812	HCCa6UDmScEjiHiAbQ.exe
6880	HCCa6UDmScEjiHiAbQ.exe
7008	HCCa6UDmScEjiHiAbQ.exe
7112	HCCa6UDmScEjiHiAbQ.exe
5956	HCCa6UDmScEjiHiAbQ.exe
3796	HCCa6UDmScEjiHiAbQ.exe
5480	HCCa6UDmScEjiHiAbQ.exe
5888	HCCa6UDmScEjiHiAbQ.exe
6448	HCCa6UDmScEjiHiAbQ.exe
6704	HCCa6UDmScEjiHiAbQ.exe
6892	HCCa6UDmScEjiHiAbQ.exe
7228	HCCa6UDmScEjiHiAbQ.exe
7332	HCCa6UDmScEjiHiAbQ.exe
7400	HCCa6UDmScEjiHiAbQ.exe
7528	HCCa6UDmScEjiHiAbQ.exe
7632	HCCa6UDmScEjiHiAbQ.exe
7700	HCCa6UDmScEjiHiAbQ.exe
7828	HCCa6UDmScEjiHiAbQ.exe
7932	HCCa6UDmScEjiHiAbQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HCCa6UDmScEjiHiAbQ = "C:\\Users\\Admin\\Documents\\ZdiVC4UP8k7Z8ZCYjQ\\HCCa6UDmScEjiHiAbQ.exe"	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 3932 set thread context of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 4872 set thread context of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 3932 set thread context of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 4872 set thread context of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 3932 set thread context of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 4872 set thread context of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 3932 set thread context of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 4872 set thread context of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 3932 set thread context of 1464	3932	HCCa6UDmScEjiHiAbQ.exe	99
PID 4872 set thread context of 4180	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 3932 set thread context of 2416	3932	HCCa6UDmScEjiHiAbQ.exe	101
PID 4872 set thread context of 216	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	102
PID 3932 set thread context of 4904	3932	HCCa6UDmScEjiHiAbQ.exe	103
PID 4872 set thread context of 632	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	104
PID 3932 set thread context of 1224	3932	HCCa6UDmScEjiHiAbQ.exe	105
PID 4872 set thread context of 2888	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	106
PID 3932 set thread context of 4960	3932	HCCa6UDmScEjiHiAbQ.exe	107
PID 4872 set thread context of 2464	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	108
PID 3932 set thread context of 3060	3932	HCCa6UDmScEjiHiAbQ.exe	109
PID 4872 set thread context of 4844	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	110
PID 3932 set thread context of 3152	3932	HCCa6UDmScEjiHiAbQ.exe	111
PID 4872 set thread context of 3456	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	112
PID 3932 set thread context of 2124	3932	HCCa6UDmScEjiHiAbQ.exe	113
PID 4872 set thread context of 1972	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	114
PID 3932 set thread context of 3076	3932	HCCa6UDmScEjiHiAbQ.exe	115
PID 4872 set thread context of 4296	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	116
PID 3932 set thread context of 1676	3932	HCCa6UDmScEjiHiAbQ.exe	117
PID 4872 set thread context of 4840	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	118
PID 3932 set thread context of 1404	3932	HCCa6UDmScEjiHiAbQ.exe	119
PID 4872 set thread context of 4620	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	120
PID 3932 set thread context of 4948	3932	HCCa6UDmScEjiHiAbQ.exe	121
PID 4872 set thread context of 4332	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	122
PID 3932 set thread context of 2560	3932	HCCa6UDmScEjiHiAbQ.exe	123
PID 4872 set thread context of 3536	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	124
PID 3932 set thread context of 4276	3932	HCCa6UDmScEjiHiAbQ.exe	125
PID 4872 set thread context of 3812	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	126
PID 3932 set thread context of 4860	3932	HCCa6UDmScEjiHiAbQ.exe	127
PID 4872 set thread context of 2680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	128
PID 3932 set thread context of 1636	3932	HCCa6UDmScEjiHiAbQ.exe	129
PID 4872 set thread context of 1256	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	130
PID 3932 set thread context of 4292	3932	HCCa6UDmScEjiHiAbQ.exe	131
PID 4872 set thread context of 1000	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	132
PID 3932 set thread context of 4796	3932	HCCa6UDmScEjiHiAbQ.exe	133
PID 4872 set thread context of 2836	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	134
PID 3932 set thread context of 5148	3932	HCCa6UDmScEjiHiAbQ.exe	135
PID 4872 set thread context of 5204	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	136
PID 3932 set thread context of 5256	3932	HCCa6UDmScEjiHiAbQ.exe	137
PID 4872 set thread context of 5340	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	138
PID 3932 set thread context of 5356	3932	HCCa6UDmScEjiHiAbQ.exe	139
PID 4872 set thread context of 5412	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	140
PID 3932 set thread context of 5456	3932	HCCa6UDmScEjiHiAbQ.exe	141
PID 4872 set thread context of 5508	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	142
PID 3932 set thread context of 5556	3932	HCCa6UDmScEjiHiAbQ.exe	143
PID 4872 set thread context of 5608	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	144
PID 3932 set thread context of 5624	3932	HCCa6UDmScEjiHiAbQ.exe	145
PID 4872 set thread context of 5708	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	146
PID 3932 set thread context of 5752	3932	HCCa6UDmScEjiHiAbQ.exe	147
PID 4872 set thread context of 5808	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	148
PID 3932 set thread context of 5856	3932	HCCa6UDmScEjiHiAbQ.exe	149
PID 4872 set thread context of 5908	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	150
PID 3932 set thread context of 5924	3932	HCCa6UDmScEjiHiAbQ.exe	151
PID 4872 set thread context of 6008	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	152
PID 3932 set thread context of 6052	3932	HCCa6UDmScEjiHiAbQ.exe	153

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 4872 wrote to memory of 4356	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	90
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 3932 wrote to memory of 2436	3932	HCCa6UDmScEjiHiAbQ.exe	91
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 4872 wrote to memory of 4756	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	92
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 3932 wrote to memory of 1512	3932	HCCa6UDmScEjiHiAbQ.exe	93
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 4872 wrote to memory of 2952	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 3932 wrote to memory of 3132	3932	HCCa6UDmScEjiHiAbQ.exe	95
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 4872 wrote to memory of 4312	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 3932 wrote to memory of 5068	3932	HCCa6UDmScEjiHiAbQ.exe	97
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 3932 wrote to memory of 1464	3932	HCCa6UDmScEjiHiAbQ.exe	99
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 4872 wrote to memory of 1680	4872	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.80.67.162:50002"
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "139.162.14.142:50002"
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.64.116.15:50002"
  2⤵
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.79.90.70:50002"
  2⤵
  PID:4312
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "178.32.223.22:50002"
  2⤵
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.80.227.49:50002"
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.68.251.200:50002"
  2⤵
  PID:216
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "205.197.210.32:50002"
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.30.215.42:50002"
  2⤵
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "165.227.22.180:50002"
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.119:50002"
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.120:50002"
  2⤵
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.36.234.239:50002"
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.101:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.138.246:50002"
  2⤵
  PID:3536
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.174.26.91:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.183.158.170:50002"
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "193.58.196.212:50002"
  2⤵
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.212.32.151:50002"
  2⤵
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "44.209.47.121:50002"
  2⤵
  PID:5340
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.253.26:50002"
  2⤵
  PID:5412
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.181.61.140:50002"
  2⤵
  PID:5508
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.28.117:50002"
  2⤵
  PID:5608
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "188.138.88.42:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5708
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.249.224:50002"
  2⤵
  PID:5808
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.10.11.242:50002"
  2⤵
  PID:5908
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "84.195.61.95:50002"
  2⤵
  PID:6008
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.187.27:50002"
  2⤵
  PID:6108
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "176.31.252.219:50002"
  2⤵
  PID:3736
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.99.212.148:50002"
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.106.98:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.91.74:50002"
  2⤵
  PID:5432
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "2.236.8.149:50002"
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.6.26:50002"
  2⤵
  PID:6164
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.11.31.76:50002"
  2⤵
  PID:6264
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.249.48.200:50002"
  2⤵
  PID:6364
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.103.153.90:50002"
  2⤵
  PID:6464
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.138.64:50002"
  2⤵
  PID:6564
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:6664
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:6764
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "3.81.142.67:50002"
  2⤵
  PID:6864
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.1.145:50002"
  2⤵
  PID:6964
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:7064
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:5904
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.183.227:50002"
  2⤵
  PID:5144
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:5784
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:6356
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:6604
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.109:50002"
  2⤵
  PID:6844
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.241.196:50002"
  2⤵
  PID:7184
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.39.205:50002"
  2⤵
  PID:7284
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.87.37.152:50002"
  2⤵
  PID:7384
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.205.8.78:50002"
  2⤵
  PID:7484
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.86.243.241:50002"
  2⤵
  PID:7584
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.71.109.91:50002"
  2⤵
  PID:7684
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "162.216.16.225:50002"
  2⤵
  PID:7784
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.91.90.62:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7884
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.64.46.27:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7984
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.47.61.83:50002"
  2⤵
  PID:8088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "118.86.185.36:50002"
  2⤵
  PID:8184
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.3:50002"
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.99.162.199:50002"
  2⤵
  PID:6320
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "50.35.67.146:50002"
  2⤵
  PID:6920
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "67.205.187.44:50002"
  2⤵
  PID:7372
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.143.214.223:50002"
  2⤵
  PID:7580
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.180.251.11:50002"
  2⤵
  PID:7820
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.77.78:50002"
  2⤵
  PID:8056
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.141.73:50002"
  2⤵
  PID:8236
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.230.24.38:50002"
  2⤵
  PID:8332
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "109.192.105.174:50002"
  2⤵
  PID:8428
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:8524
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.206.105.42:50002"
  2⤵
  PID:8620
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:8716
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "89.58.60.208:50002"
  2⤵
  PID:8812
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.217.32.30:50002"
  2⤵
  PID:8908
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.111:110"
  2⤵
  PID:9004
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "149.56.79.70:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9100
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "99.199.133.225:50002"
  2⤵
  PID:9196
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:6208
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:7412
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.107:50002"
  2⤵
  PID:7964
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:8328
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.25.36:50002"
  2⤵
  PID:8560
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.222.87:50002"
  2⤵
  PID:8796
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.6:50002"
  2⤵
  PID:9248
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9344
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:995"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9440
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.169.69.26:50002"
  2⤵
  PID:9536
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:9632
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "65.21.18.44:50002"
  2⤵
  PID:9728
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:9824
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "77.74.80.179:50002"
  2⤵
  PID:9920
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.208.189.99:50002"
  2⤵
  PID:10016
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.106:50002"
  2⤵
  PID:10112
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "116.202.84.94:50002"
  2⤵
  PID:10208
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "1.2.3.4:50002"
  2⤵
  PID:9108
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.10.251:50002"
  2⤵
  PID:6948
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:8300
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.154.223.80:50002"
  2⤵
  PID:8852
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "34.41.139.193:50002"
  2⤵
  PID:9408
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.137.245.3:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9640
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:9876
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "82.212.38.116:50002"
  2⤵
  PID:10108
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.72.78:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10260
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.196.113.153:50002"
  2⤵
  PID:10364
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "144.202.14.107:50002"
  2⤵
  PID:10460
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.46.177.74:50002"
  2⤵
  PID:10556
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.116:50002"
  2⤵
  PID:10620
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.18.112:50002"
  2⤵
  PID:10712
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.181.158:50002"
  2⤵
  PID:10840
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "73.116.136.143:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10936
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.211.185.14:443"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11036
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "96.27.8.242:50002"
  2⤵
  PID:11132
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "220.233.178.199:50002"
  2⤵
  PID:11228
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7460
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50012"
  2⤵
  PID:9320
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.100:50002"
  2⤵
  PID:9672
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.80.67.162:50002"
  2⤵
  PID:11224
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "139.162.14.142:50002"
  2⤵
  PID:8400
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.64.116.15:50002"
  2⤵
  PID:8552
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.79.90.70:50002"
  2⤵
  PID:8360
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "178.32.223.22:50002"
  2⤵
  PID:9452
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.80.227.49:50002"
  2⤵
  PID:8076
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.68.251.200:50002"
  2⤵
  PID:9724
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.30.215.42:50002"
  2⤵
  PID:8372
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "165.227.22.180:50002"
  2⤵
  PID:9084
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "205.197.210.32:50002"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.119:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9792
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.120:50002"
  2⤵
  PID:9092
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.36.234.239:50002"
  2⤵
  PID:5232
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.101:50002"
  2⤵
  PID:10920
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:9912
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:8152
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:8104
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.138.246:50002"
  2⤵
  PID:10084
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.174.26.91:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10652
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5520
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.183.158.170:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9360
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "193.58.196.212:50002"
  2⤵
  PID:8660
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.212.32.151:50002"
  2⤵
  PID:7792
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "44.209.47.121:50002"
  2⤵
  PID:6228
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.253.26:50002"
  2⤵
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.181.61.140:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.28.117:50002"
  2⤵
  PID:7256
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "188.138.88.42:50002"
  2⤵
  PID:7996
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.249.224:50002"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.10.11.242:50002"
  2⤵
  PID:9760
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "84.195.61.95:50002"
  2⤵
  PID:7084
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.187.27:50002"
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "176.31.252.219:50002"
  2⤵
  PID:8496
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.99.212.148:50002"
  2⤵
  PID:10492
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.106.98:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8212
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.91.74:50002"
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "2.236.8.149:50002"
  2⤵
  PID:10700
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.6.26:50002"
  2⤵
  PID:6648
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.11.31.76:50002"
  2⤵
  PID:8256
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.249.48.200:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9644
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.103.153.90:50002"
  2⤵
  PID:8688
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.138.64:50002"
  2⤵
  PID:11196
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:6988
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "3.81.142.67:50002"
  2⤵
  PID:8032
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.1.145:50002"
  2⤵
  PID:6328
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:4248
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:8260
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.183.227:50002"
  2⤵
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:2244
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:8440
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.241.196:50002"
  2⤵
  PID:9400
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.39.205:50002"
  2⤵
  PID:5428
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.87.37.152:50002"
  2⤵
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.205.8.78:50002"
  2⤵
  PID:6188
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.86.243.241:50002"
  2⤵
  PID:9520
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.71.109.91:50002"
  2⤵
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "162.216.16.225:50002"
  2⤵
  PID:6936
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.91.90.62:50002"
  2⤵
  PID:8308
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.64.46.27:50002"
  2⤵
  PID:6300
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.47.61.83:50002"
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "118.86.185.36:50002"
  2⤵
  PID:11120
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.3:50002"
  2⤵
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.99.162.199:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "50.35.67.146:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:308
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "67.205.187.44:50002"
  2⤵
  PID:5872
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.143.214.223:50002"
  2⤵
  PID:6380
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.180.251.11:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8900
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.77.78:50002"
  2⤵
  PID:5288
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.141.73:50002"
  2⤵
  PID:10060
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.230.24.38:50002"
  2⤵
  PID:6676
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "109.192.105.174:50002"
  2⤵
  PID:10756
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:6772
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.206.105.42:50002"
  2⤵
  PID:7480
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:8488
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "89.58.60.208:50002"
  2⤵
  PID:6744
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.217.32.30:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "149.56.79.70:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6832
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "99.199.133.225:50002"
  2⤵
  PID:11200
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:10076
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:7864
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.107:50002"
  2⤵
  PID:9836
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:10748
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.25.36:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.222.87:50002"
  2⤵
  PID:8476
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.6:50002"
  2⤵
  PID:10644
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:7608
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:995"
  2⤵
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.169.69.26:50002"
  2⤵
  PID:11004
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "65.21.18.44:50002"
  2⤵
  PID:10428
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "77.74.80.179:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7780
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.208.189.99:50002"
  2⤵
  PID:6040
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.106:50002"
  2⤵
  PID:8320
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "116.202.84.94:50002"
  2⤵
  PID:10684
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "1.2.3.4:50002"
  2⤵
  PID:7836
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.10.251:50002"
  2⤵
  PID:11304
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:11448
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.154.223.80:50002"
  2⤵
  PID:7360
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "34.41.139.193:50002"
  2⤵
  PID:11608
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.137.245.3:50002"
  2⤵
  PID:11724
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:8600
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "82.212.38.116:50002"
  2⤵
  PID:2088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.72.78:50002"
  2⤵
  PID:7844
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.196.113.153:50002"
  2⤵
  PID:11864
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "144.202.14.107:50002"
  2⤵
  PID:11876
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.46.177.74:50002"
  2⤵
  PID:9204
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.116:50002"
  2⤵
  PID:7852
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.18.112:50002"
  2⤵
  PID:7192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.181.158:50002"
  2⤵
  PID:6928
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "73.116.136.143:50002"
  2⤵
  PID:6784
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.211.185.14:443"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "96.27.8.242:50002"
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "220.233.178.199:50002"
  2⤵
  PID:10088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50002"
  2⤵
  PID:10248
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50012"
  2⤵
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.100:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:916

C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.80.67.162:50002"
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "139.162.14.142:50002"
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.64.116.15:50002"
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.79.90.70:50002"
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "178.32.223.22:50002"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.80.227.49:50002"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.68.251.200:50002"
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "205.197.210.32:50002"
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.30.215.42:50002"
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "165.227.22.180:50002"
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.119:50002"
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.120:50002"
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.36.234.239:50002"
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.101:50002"
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4948
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.138.246:50002"
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.174.26.91:50002"
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.183.158.170:50002"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "193.58.196.212:50002"
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.212.32.151:50002"
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "44.209.47.121:50002"
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.253.26:50002"
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.181.61.140:50002"
  2⤵
  - Executes dropped EXE
  PID:5556
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.28.117:50002"
  2⤵
  - Executes dropped EXE
  PID:5624
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "188.138.88.42:50002"
  2⤵
  - Executes dropped EXE
  PID:5752
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.249.224:50002"
  2⤵
  - Executes dropped EXE
  PID:5856
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.10.11.242:50002"
  2⤵
  - Executes dropped EXE
  PID:5924
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "84.195.61.95:50002"
  2⤵
  - Executes dropped EXE
  PID:6052
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.187.27:50002"
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "176.31.252.219:50002"
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.99.212.148:50002"
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.106.98:50002"
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.91.74:50002"
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "2.236.8.149:50002"
  2⤵
  - Executes dropped EXE
  PID:5804
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.6.26:50002"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6212
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.11.31.76:50002"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6280
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.249.48.200:50002"
  2⤵
  - Executes dropped EXE
  PID:6408
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.103.153.90:50002"
  2⤵
  - Executes dropped EXE
  PID:6512
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.138.64:50002"
  2⤵
  - Executes dropped EXE
  PID:6580
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  - Executes dropped EXE
  PID:6708
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6812
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "3.81.142.67:50002"
  2⤵
  - Executes dropped EXE
  PID:6880
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.1.145:50002"
  2⤵
  - Executes dropped EXE
  PID:7008
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  - Executes dropped EXE
  PID:7112
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  - Executes dropped EXE
  PID:5956
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.183.227:50002"
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  - Executes dropped EXE
  PID:5888
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  - Executes dropped EXE
  PID:6448
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  - Executes dropped EXE
  PID:6704
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.109:50002"
  2⤵
  - Executes dropped EXE
  PID:6892
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.241.196:50002"
  2⤵
  - Executes dropped EXE
  PID:7228
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.39.205:50002"
  2⤵
  - Executes dropped EXE
  PID:7332
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.87.37.152:50002"
  2⤵
  - Executes dropped EXE
  PID:7400
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.205.8.78:50002"
  2⤵
  - Executes dropped EXE
  PID:7528
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.86.243.241:50002"
  2⤵
  - Executes dropped EXE
  PID:7632
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.71.109.91:50002"
  2⤵
  - Executes dropped EXE
  PID:7700
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "162.216.16.225:50002"
  2⤵
  - Executes dropped EXE
  PID:7828
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.91.90.62:50002"
  2⤵
  - Executes dropped EXE
  PID:7932
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.64.46.27:50002"
  2⤵
  PID:8000
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.47.61.83:50002"
  2⤵
  PID:8132
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "118.86.185.36:50002"
  2⤵
  PID:7164
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.3:50002"
  2⤵
  PID:4592
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.99.162.199:50002"
  2⤵
  PID:6552
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "50.35.67.146:50002"
  2⤵
  PID:7220
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "67.205.187.44:50002"
  2⤵
  PID:7380
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.143.214.223:50002"
  2⤵
  PID:7696
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.180.251.11:50002"
  2⤵
  PID:7944
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.77.78:50002"
  2⤵
  PID:8084
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.141.73:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8280
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.230.24.38:50002"
  2⤵
  PID:8380
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "109.192.105.174:50002"
  2⤵
  PID:8444
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:8568
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.206.105.42:50002"
  2⤵
  PID:8668
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8732
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "89.58.60.208:50002"
  2⤵
  PID:8856
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.217.32.30:50002"
  2⤵
  PID:8956
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.111:110"
  2⤵
  PID:9020
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "149.56.79.70:50002"
  2⤵
  PID:9144
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "99.199.133.225:50002"
  2⤵
  PID:6016
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:6420
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:7656
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.107:50002"
  2⤵
  PID:8220
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:8368
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.25.36:50002"
  2⤵
  PID:8664
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.222.87:50002"
  2⤵
  PID:8904
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.6:50002"
  2⤵
  PID:9264
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:9388
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:995"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9488
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.169.69.26:50002"
  2⤵
  PID:9552
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:9676
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "65.21.18.44:50002"
  2⤵
  PID:9776
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9840
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "77.74.80.179:50002"
  2⤵
  PID:9964
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.208.189.99:50002"
  2⤵
  PID:10064
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.106:50002"
  2⤵
  PID:10128
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "116.202.84.94:50002"
  2⤵
  PID:8984
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "1.2.3.4:50002"
  2⤵
  PID:7092
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.10.251:50002"
  2⤵
  PID:7328
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:8520
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.154.223.80:50002"
  2⤵
  PID:9300
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "34.41.139.193:50002"
  2⤵
  PID:9448
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.137.245.3:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9764
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9984
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "82.212.38.116:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10156
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.72.78:50002"
  2⤵
  PID:10304
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.196.113.153:50002"
  2⤵
  PID:10412
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "144.202.14.107:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10476
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.46.177.74:50002"
  2⤵
  PID:10568
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.116:50002"
  2⤵
  PID:10664
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.18.112:50002"
  2⤵
  PID:10728
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.181.158:50002"
  2⤵
  PID:10884
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "73.116.136.143:50002"
  2⤵
  PID:10984
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.211.185.14:443"
  2⤵
  PID:11052
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "96.27.8.242:50002"
  2⤵
  PID:11176
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "220.233.178.199:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9172
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50002"
  2⤵
  PID:7928
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50012"
  2⤵
  PID:9380
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.100:50002"
  2⤵
  PID:9736
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.80.67.162:50002"
  2⤵
  PID:3924
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "139.162.14.142:50002"
  2⤵
  PID:4884
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.64.116.15:50002"
  2⤵
  PID:9788
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.79.90.70:50002"
  2⤵
  PID:212
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "178.32.223.22:50002"
  2⤵
  PID:2600
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.80.227.49:50002"
  2⤵
  PID:10760
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.68.251.200:50002"
  2⤵
  PID:8468
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "205.197.210.32:50002"
  2⤵
  PID:5648
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.30.215.42:50002"
  2⤵
  PID:10268
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "165.227.22.180:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9900
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.119:50002"
  2⤵
  PID:5192
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.120:50002"
  2⤵
  PID:836
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.36.234.239:50002"
  2⤵
  PID:8160
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.101:50002"
  2⤵
  PID:3520
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  PID:7868
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  PID:7424
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  PID:9240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.138.246:50002"
  2⤵
  PID:2976
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.174.26.91:50002"
  2⤵
  PID:8824
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:7128
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6560
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.183.158.170:50002"
  2⤵
  PID:3204
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "193.58.196.212:50002"
  2⤵
  PID:9860
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.212.32.151:50002"
  2⤵
  PID:1924
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "44.209.47.121:50002"
  2⤵
  PID:10976
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.253.26:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6528
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.181.61.140:50002"
  2⤵
  PID:7872
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.28.117:50002"
  2⤵
  PID:8388
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "188.138.88.42:50002"
  2⤵
  PID:10376
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.249.224:50002"
  2⤵
  PID:7072
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.10.11.242:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10784
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "84.195.61.95:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10324
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.187.27:50002"
  2⤵
  PID:2752
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "176.31.252.219:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8596
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.99.212.148:50002"
  2⤵
  PID:8940
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.106.98:50002"
  2⤵
  PID:8644
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.91.74:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9224
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "2.236.8.149:50002"
  2⤵
  PID:10736
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.6.26:50002"
  2⤵
  PID:9956
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.11.31.76:50002"
  2⤵
  PID:5748
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.249.48.200:50002"
  2⤵
  PID:4088
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.103.153.90:50002"
  2⤵
  PID:4472
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.138.64:50002"
  2⤵
  PID:3604
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:8312
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:10812
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "3.81.142.67:50002"
  2⤵
  PID:9716
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.1.145:50002"
  2⤵
  PID:9404
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  PID:10680
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  PID:5632
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5864
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.183.227:50002"
  2⤵
  PID:8744
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  PID:7028
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  PID:7728
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  PID:7840
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.241.196:50002"
  2⤵
  PID:6240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.39.205:50002"
  2⤵
  PID:4264
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.87.37.152:50002"
  2⤵
  PID:10532
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.205.8.78:50002"
  2⤵
  PID:3572
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.86.243.241:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7416
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.71.109.91:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5644
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "162.216.16.225:50002"
  2⤵
  PID:4228
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.91.90.62:50002"
  2⤵
  PID:7764
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.64.46.27:50002"
  2⤵
  PID:1772
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.47.61.83:50002"
  2⤵
  PID:9996
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "118.86.185.36:50002"
  2⤵
  PID:628
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.3:50002"
  2⤵
  PID:7312
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.99.162.199:50002"
  2⤵
  PID:7540
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "50.35.67.146:50002"
  2⤵
  PID:7100
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "67.205.187.44:50002"
  2⤵
  PID:3240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.143.214.223:50002"
  2⤵
  PID:6172
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.180.251.11:50002"
  2⤵
  PID:8932
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.77.78:50002"
  2⤵
  PID:7464
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.141.73:50002"
  2⤵
  PID:10372
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.230.24.38:50002"
  2⤵
  PID:4212
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "109.192.105.174:50002"
  2⤵
  PID:7152
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:9856
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.206.105.42:50002"
  2⤵
  PID:8764
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:9164
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "89.58.60.208:50002"
  2⤵
  PID:4444
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.217.32.30:50002"
  2⤵
  PID:10092
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.111:110"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2340
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "149.56.79.70:50002"
  2⤵
  PID:7468
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "99.199.133.225:50002"
  2⤵
  PID:6116
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:6440
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8008
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.107:50002"
  2⤵
  PID:2660
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:3496
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.25.36:50002"
  2⤵
  PID:4676
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.222.87:50002"
  2⤵
  PID:4540
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.6:50002"
  2⤵
  PID:2584
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8420
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:995"
  2⤵
  PID:8304
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.169.69.26:50002"
  2⤵
  PID:8460
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:9576
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "65.21.18.44:50002"
  2⤵
  PID:2664
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:9700
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "77.74.80.179:50002"
  2⤵
  PID:11320
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.208.189.99:50002"
  2⤵
  PID:11372
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.106:50002"
  2⤵
  PID:11420
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "116.202.84.94:50002"
  2⤵
  PID:11468
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "1.2.3.4:50002"
  2⤵
  PID:11516
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.10.251:50002"
  2⤵
  PID:11564
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:11612
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.154.223.80:50002"
  2⤵
  PID:11316
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "34.41.139.193:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.137.245.3:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11428
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:7352
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "82.212.38.116:50002"
  2⤵
  PID:11680
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.72.78:50002"
  2⤵
  PID:11716
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.196.113.153:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6548
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "144.202.14.107:50002"
  2⤵
  PID:11068
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.46.177.74:50002"
  2⤵
  PID:11812
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.116:50002"
  2⤵
  PID:11240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.18.112:50002"
  2⤵
  PID:11244
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.181.158:50002"
  2⤵
  PID:5588
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "73.116.136.143:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11972
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.211.185.14:443"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "96.27.8.242:50002"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12012
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "220.233.178.199:50002"
  2⤵
  PID:10608
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50002"
  2⤵
  PID:12108
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50012"
  2⤵
  PID:12104
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.100:50002"
  2⤵
  PID:7292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HCCa6UDmScEjiHiAbQ.exe

Path C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
Size 3.9MB
SHA256 a38e6cdf99edb830eb40a4610a4bf7fccd87447c88da5f0286d57a2f095ec208
MD5 03cb870036b26bdf1240787a96ad1ef0
SHA1 37aa2905eeacf2f0a7981b91adf4b8ef24613e5a
SHA512 7860e633b4dab50522e51966cd28678544b35b25ef1f4405c1d7628b7e875c6393e4e2a72cbf344b434a35102aac683e3a95eb9098c57a695bd7da68336df057
SSDEEP 49152:F0ktHFMh6zvqnvs0+vaO57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTr7c+DNE/l6RROQ+
TLSH
T151168D60FDDB50F9EA03183145ABA27FA33467195335CBC7C7401E9AE86BAE15D33229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-78-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/216-74-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/216-77-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/632-115-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/632-114-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/632-113-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1224-99-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1224-98-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1224-97-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1464-46-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1464-45-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1464-47-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1512-30-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1512-32-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1512-1791-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1512-2466-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1512-48-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1512-34-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1680-83-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1680-84-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1680-85-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1972-135-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1972-136-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2416-59-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2416-60-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2416-61-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-14-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-7-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-2337-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-9-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-8-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-10-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2436-1790-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2464-107-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2464-106-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2464-108-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2888-132-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2888-131-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2888-130-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2952-2321-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2952-80-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2952-1945-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2952-70-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2952-69-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2952-71-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3060-126-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3060-128-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3060-127-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3132-49-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3132-39-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3132-40-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3132-2097-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3132-42-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3132-1886-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4180-102-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4180-101-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4180-103-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4312-66-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4312-88-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4312-1921-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4312-64-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4312-65-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4356-35-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4356-3-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4356-22-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4356-21-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4356-20-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4356-1574-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4756-1890-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4756-52-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4756-53-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4756-55-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4756-79-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4756-2297-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4904-94-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4904-95-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4904-93-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4960-119-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4960-120-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4960-121-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5068-33-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5068-29-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5068-31-0x0000000000400000-0x0000000000768000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads