c567f2b67d485fe319a9599b6a7a80d9d24e2646dc8bf6457b4e2b839a0d79a3

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Size 3.9MB
Sample260823-qhrgjaxbme
SHA256 c567f2b67d485fe319a9599b6a7a80d9d24e2646dc8bf6457b4e2b839a0d79a3
MD5 0665dea4dcaa7eab82b14b46feb7387e
SHA1 ca53dc5b050ee4b5775ed41ccb85bbc893852b25
SHA512 dbb8f8b7691663c46ae081aa83268a1b776b36ddab83b298e60ef317a8dc32340c9ff6ffaea3207c6c0933769dc9929e96d10642f869394275922891833b7c58
SSDEEP 49152:F0ktHFMh6zvqnvs0+v+O57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTP7c+DNE/l6RROQ+
TLSH
T161168D60FDDB50F9EA03183145ABA27FA33467195335CBC7C7401E9AE86BAE15D33229
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2740	HCCa6UDmScEjiHiAbQ.exe
2600	HCCa6UDmScEjiHiAbQ.exe
1844	HCCa6UDmScEjiHiAbQ.exe
6068	HCCa6UDmScEjiHiAbQ.exe
5224	HCCa6UDmScEjiHiAbQ.exe
4300	HCCa6UDmScEjiHiAbQ.exe
5652	HCCa6UDmScEjiHiAbQ.exe
3932	HCCa6UDmScEjiHiAbQ.exe
2324	HCCa6UDmScEjiHiAbQ.exe
2732	HCCa6UDmScEjiHiAbQ.exe
260	HCCa6UDmScEjiHiAbQ.exe
3148	HCCa6UDmScEjiHiAbQ.exe
2772	HCCa6UDmScEjiHiAbQ.exe
5852	HCCa6UDmScEjiHiAbQ.exe
1848	HCCa6UDmScEjiHiAbQ.exe
2552	HCCa6UDmScEjiHiAbQ.exe
3360	HCCa6UDmScEjiHiAbQ.exe
5788	HCCa6UDmScEjiHiAbQ.exe
3596	HCCa6UDmScEjiHiAbQ.exe
4736	HCCa6UDmScEjiHiAbQ.exe
5688	HCCa6UDmScEjiHiAbQ.exe
5984	HCCa6UDmScEjiHiAbQ.exe
4292	HCCa6UDmScEjiHiAbQ.exe
244	HCCa6UDmScEjiHiAbQ.exe
1948	HCCa6UDmScEjiHiAbQ.exe
5528	HCCa6UDmScEjiHiAbQ.exe
5644	HCCa6UDmScEjiHiAbQ.exe
2512	HCCa6UDmScEjiHiAbQ.exe
1644	HCCa6UDmScEjiHiAbQ.exe
6120	HCCa6UDmScEjiHiAbQ.exe
5416	HCCa6UDmScEjiHiAbQ.exe
4132	HCCa6UDmScEjiHiAbQ.exe
3164	HCCa6UDmScEjiHiAbQ.exe
3928	HCCa6UDmScEjiHiAbQ.exe
5632	HCCa6UDmScEjiHiAbQ.exe
5616	HCCa6UDmScEjiHiAbQ.exe
1628	HCCa6UDmScEjiHiAbQ.exe
1984	HCCa6UDmScEjiHiAbQ.exe
3688	HCCa6UDmScEjiHiAbQ.exe
6008	HCCa6UDmScEjiHiAbQ.exe
1044	HCCa6UDmScEjiHiAbQ.exe
1636	HCCa6UDmScEjiHiAbQ.exe
568	HCCa6UDmScEjiHiAbQ.exe
2468	HCCa6UDmScEjiHiAbQ.exe
5032	HCCa6UDmScEjiHiAbQ.exe
5444	HCCa6UDmScEjiHiAbQ.exe
4272	HCCa6UDmScEjiHiAbQ.exe
1496	HCCa6UDmScEjiHiAbQ.exe
760	HCCa6UDmScEjiHiAbQ.exe
2356	HCCa6UDmScEjiHiAbQ.exe
1056	HCCa6UDmScEjiHiAbQ.exe
3832	HCCa6UDmScEjiHiAbQ.exe
2056	HCCa6UDmScEjiHiAbQ.exe
3044	HCCa6UDmScEjiHiAbQ.exe
4612	HCCa6UDmScEjiHiAbQ.exe
4408	HCCa6UDmScEjiHiAbQ.exe
2880	HCCa6UDmScEjiHiAbQ.exe
1708	HCCa6UDmScEjiHiAbQ.exe
4636	HCCa6UDmScEjiHiAbQ.exe
1356	HCCa6UDmScEjiHiAbQ.exe
5648	HCCa6UDmScEjiHiAbQ.exe
1632	HCCa6UDmScEjiHiAbQ.exe
4252	HCCa6UDmScEjiHiAbQ.exe
4556	HCCa6UDmScEjiHiAbQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCCa6UDmScEjiHiAbQ = "C:\\Users\\Admin\\Documents\\ZdiVC4UP8k7Z8ZCYjQ\\HCCa6UDmScEjiHiAbQ.exe"	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2740 set thread context of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2776 set thread context of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2740 set thread context of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2776 set thread context of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2740 set thread context of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2776 set thread context of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2740 set thread context of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2776 set thread context of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 set thread context of 4680	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	101
PID 2740 set thread context of 4300	2740	HCCa6UDmScEjiHiAbQ.exe	102
PID 2740 set thread context of 5652	2740	HCCa6UDmScEjiHiAbQ.exe	104
PID 2776 set thread context of 2136	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	103
PID 2776 set thread context of 1280	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	105
PID 2776 set thread context of 5676	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	106
PID 2740 set thread context of 3932	2740	HCCa6UDmScEjiHiAbQ.exe	107
PID 2776 set thread context of 5188	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	108
PID 2740 set thread context of 2324	2740	HCCa6UDmScEjiHiAbQ.exe	109
PID 2776 set thread context of 756	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	110
PID 2740 set thread context of 2732	2740	HCCa6UDmScEjiHiAbQ.exe	112
PID 2740 set thread context of 260	2740	HCCa6UDmScEjiHiAbQ.exe	113
PID 2740 set thread context of 3148	2740	HCCa6UDmScEjiHiAbQ.exe	114
PID 2740 set thread context of 2772	2740	HCCa6UDmScEjiHiAbQ.exe	115
PID 2776 set thread context of 1008	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	111
PID 2740 set thread context of 5852	2740	HCCa6UDmScEjiHiAbQ.exe	116
PID 2740 set thread context of 1848	2740	HCCa6UDmScEjiHiAbQ.exe	118
PID 2740 set thread context of 2552	2740	HCCa6UDmScEjiHiAbQ.exe	119
PID 2776 set thread context of 3496	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	117
PID 2740 set thread context of 3360	2740	HCCa6UDmScEjiHiAbQ.exe	120
PID 2776 set thread context of 3060	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	121
PID 2776 set thread context of 1408	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	123
PID 2740 set thread context of 5788	2740	HCCa6UDmScEjiHiAbQ.exe	122
PID 2740 set thread context of 3596	2740	HCCa6UDmScEjiHiAbQ.exe	125
PID 2776 set thread context of 4856	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	124
PID 2740 set thread context of 4736	2740	HCCa6UDmScEjiHiAbQ.exe	126
PID 2776 set thread context of 5780	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	127
PID 2776 set thread context of 2032	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	128
PID 2776 set thread context of 2328	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	130
PID 2740 set thread context of 5688	2740	HCCa6UDmScEjiHiAbQ.exe	129
PID 2776 set thread context of 1748	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	131
PID 2740 set thread context of 5984	2740	HCCa6UDmScEjiHiAbQ.exe	132
PID 2740 set thread context of 4292	2740	HCCa6UDmScEjiHiAbQ.exe	133
PID 2740 set thread context of 244	2740	HCCa6UDmScEjiHiAbQ.exe	135
PID 2776 set thread context of 2500	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	134
PID 2740 set thread context of 1948	2740	HCCa6UDmScEjiHiAbQ.exe	136
PID 2776 set thread context of 4140	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	137
PID 2776 set thread context of 1136	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	139
PID 2740 set thread context of 5528	2740	HCCa6UDmScEjiHiAbQ.exe	138
PID 2776 set thread context of 4532	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	140
PID 2740 set thread context of 5644	2740	HCCa6UDmScEjiHiAbQ.exe	141
PID 2740 set thread context of 2512	2740	HCCa6UDmScEjiHiAbQ.exe	142
PID 2776 set thread context of 4668	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	143
PID 2740 set thread context of 1644	2740	HCCa6UDmScEjiHiAbQ.exe	144
PID 2776 set thread context of 1360	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	145
PID 2776 set thread context of 2528	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	147
PID 2740 set thread context of 6120	2740	HCCa6UDmScEjiHiAbQ.exe	146
PID 2776 set thread context of 4040	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	148
PID 2740 set thread context of 5416	2740	HCCa6UDmScEjiHiAbQ.exe	149
PID 2776 set thread context of 5724	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	150
PID 2776 set thread context of 5328	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	152
PID 2740 set thread context of 4132	2740	HCCa6UDmScEjiHiAbQ.exe	151
PID 2740 set thread context of 3164	2740	HCCa6UDmScEjiHiAbQ.exe	153
PID 2740 set thread context of 3928	2740	HCCa6UDmScEjiHiAbQ.exe	154
PID 2740 set thread context of 5632	2740	HCCa6UDmScEjiHiAbQ.exe	156

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCCa6UDmScEjiHiAbQ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2776 wrote to memory of 5172	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	93
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2740 wrote to memory of 2600	2740	HCCa6UDmScEjiHiAbQ.exe	92
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2776 wrote to memory of 2192	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	94
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2740 wrote to memory of 1844	2740	HCCa6UDmScEjiHiAbQ.exe	95
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2776 wrote to memory of 1776	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	96
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2740 wrote to memory of 6068	2740	HCCa6UDmScEjiHiAbQ.exe	97
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2776 wrote to memory of 5892	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	98
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2740 wrote to memory of 5224	2740	HCCa6UDmScEjiHiAbQ.exe	99
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 wrote to memory of 5260	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	100
PID 2776 wrote to memory of 4680	2776	2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.80.67.162:50002"
  2⤵
  PID:5172
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "139.162.14.142:50002"
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.64.116.15:50002"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.79.90.70:50002"
  2⤵
  PID:5892
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "178.32.223.22:50002"
  2⤵
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.80.227.49:50002"
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.68.251.200:50002"
  2⤵
  PID:2136
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "205.197.210.32:50002"
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.30.215.42:50002"
  2⤵
  PID:5676
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "165.227.22.180:50002"
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.119:50002"
  2⤵
  PID:756
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.120:50002"
  2⤵
  PID:1008
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.36.234.239:50002"
  2⤵
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.101:50002"
  2⤵
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:1408
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:4856
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:5780
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.138.246:50002"
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.174.26.91:50002"
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.183.158.170:50002"
  2⤵
  PID:4140
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "193.58.196.212:50002"
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.212.32.151:50002"
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "44.209.47.121:50002"
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.253.26:50002"
  2⤵
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.181.61.140:50002"
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.28.117:50002"
  2⤵
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "188.138.88.42:50002"
  2⤵
  PID:5724
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.249.224:50002"
  2⤵
  PID:5328
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.10.11.242:50002"
  2⤵
  PID:700
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "84.195.61.95:50002"
  2⤵
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.187.27:50002"
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "176.31.252.219:50002"
  2⤵
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.99.212.148:50002"
  2⤵
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.106.98:50002"
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.91.74:50002"
  2⤵
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "2.236.8.149:50002"
  2⤵
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.6.26:50002"
  2⤵
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.11.31.76:50002"
  2⤵
  PID:5360
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.249.48.200:50002"
  2⤵
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.103.153.90:50002"
  2⤵
  PID:796
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.138.64:50002"
  2⤵
  PID:460
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:4720
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "3.81.142.67:50002"
  2⤵
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.1.145:50002"
  2⤵
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:5672
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.183.227:50002"
  2⤵
  PID:2180
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:1392
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.109:50002"
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.241.196:50002"
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.39.205:50002"
  2⤵
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.87.37.152:50002"
  2⤵
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.205.8.78:50002"
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.86.243.241:50002"
  2⤵
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.71.109.91:50002"
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "162.216.16.225:50002"
  2⤵
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.91.90.62:50002"
  2⤵
  PID:200
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.64.46.27:50002"
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.47.61.83:50002"
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "118.86.185.36:50002"
  2⤵
  PID:6112
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.3:50002"
  2⤵
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.99.162.199:50002"
  2⤵
  PID:3532
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "50.35.67.146:50002"
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "67.205.187.44:50002"
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.143.214.223:50002"
  2⤵
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.180.251.11:50002"
  2⤵
  PID:972
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.77.78:50002"
  2⤵
  PID:4456
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.141.73:50002"
  2⤵
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.230.24.38:50002"
  2⤵
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "109.192.105.174:50002"
  2⤵
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.206.105.42:50002"
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "89.58.60.208:50002"
  2⤵
  PID:6128
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.217.32.30:50002"
  2⤵
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.111:110"
  2⤵
  PID:6132
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "149.56.79.70:50002"
  2⤵
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "99.199.133.225:50002"
  2⤵
  PID:572
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:4600
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:4896
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.107:50002"
  2⤵
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.25.36:50002"
  2⤵
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.222.87:50002"
  2⤵
  PID:6168
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.6:50002"
  2⤵
  PID:6192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:6232
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:995"
  2⤵
  PID:6296
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.169.69.26:50002"
  2⤵
  PID:6368
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:6392
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "65.21.18.44:50002"
  2⤵
  PID:6428
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:6456
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "77.74.80.179:50002"
  2⤵
  PID:6484
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.208.189.99:50002"
  2⤵
  PID:6504
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.106:50002"
  2⤵
  PID:6520
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "116.202.84.94:50002"
  2⤵
  PID:6540
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "1.2.3.4:50002"
  2⤵
  PID:6564
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.10.251:50002"
  2⤵
  PID:6584
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:6600
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.154.223.80:50002"
  2⤵
  PID:6620
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "34.41.139.193:50002"
  2⤵
  PID:6644
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.137.245.3:50002"
  2⤵
  PID:6664
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:6680
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "82.212.38.116:50002"
  2⤵
  PID:6700
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.72.78:50002"
  2⤵
  PID:6732
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.196.113.153:50002"
  2⤵
  PID:6744
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "144.202.14.107:50002"
  2⤵
  PID:6760
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.46.177.74:50002"
  2⤵
  PID:6780
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.116:50002"
  2⤵
  PID:6804
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.181.158:50002"
  2⤵
  PID:6824
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.18.112:50002"
  2⤵
  PID:6840
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "73.116.136.143:50002"
  2⤵
  PID:6860
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.211.185.14:443"
  2⤵
  PID:6892
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "96.27.8.242:50002"
  2⤵
  PID:6904
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "220.233.178.199:50002"
  2⤵
  PID:6920
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50002"
  2⤵
  PID:6952
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50012"
  2⤵
  PID:6964
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.100:50002"
  2⤵
  PID:6980
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.80.67.162:50002"
  2⤵
  PID:6288
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "139.162.14.142:50002"
  2⤵
  PID:6320
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.64.116.15:50002"
  2⤵
  PID:6364
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.79.90.70:50002"
  2⤵
  PID:6444
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "178.32.223.22:50002"
  2⤵
  PID:6496
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.80.227.49:50002"
  2⤵
  PID:6572
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.68.251.200:50002"
  2⤵
  PID:6652
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "205.197.210.32:50002"
  2⤵
  PID:6712
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.30.215.42:50002"
  2⤵
  PID:6776
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "165.227.22.180:50002"
  2⤵
  PID:6848
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.119:50002"
  2⤵
  PID:6912
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.120:50002"
  2⤵
  PID:6976
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.36.234.239:50002"
  2⤵
  PID:7004
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.101:50002"
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.138.246:50002"
  2⤵
  PID:5212
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.174.26.91:50002"
  2⤵
  PID:1164
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:800
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:904
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.183.158.170:50002"
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "193.58.196.212:50002"
  2⤵
  PID:1508
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.212.32.151:50002"
  2⤵
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "44.209.47.121:50002"
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.253.26:50002"
  2⤵
  PID:552
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.181.61.140:50002"
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.28.117:50002"
  2⤵
  PID:5988
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "188.138.88.42:50002"
  2⤵
  PID:916
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.249.224:50002"
  2⤵
  PID:6356
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.10.11.242:50002"
  2⤵
  PID:6516
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "84.195.61.95:50002"
  2⤵
  PID:6636
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.187.27:50002"
  2⤵
  PID:6772
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "176.31.252.219:50002"
  2⤵
  PID:6856
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.99.212.148:50002"
  2⤵
  PID:6936
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.106.98:50002"
  2⤵
  PID:6124
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.91.74:50002"
  2⤵
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "2.236.8.149:50002"
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.6.26:50002"
  2⤵
  PID:252
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.11.31.76:50002"
  2⤵
  PID:5872
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.249.48.200:50002"
  2⤵
  PID:6344
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.103.153.90:50002"
  2⤵
  PID:6440
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.138.64:50002"
  2⤵
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:6768
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:5888
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "3.81.142.67:50002"
  2⤵
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.1.145:50002"
  2⤵
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:5856
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.183.227:50002"
  2⤵
  PID:6552
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:6512
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.109:50002"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.241.196:50002"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.39.205:50002"
  2⤵
  PID:6692
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.87.37.152:50002"
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.205.8.78:50002"
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.86.243.241:50002"
  2⤵
  PID:6400
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.71.109.91:50002"
  2⤵
  PID:6796
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "162.216.16.225:50002"
  2⤵
  PID:456
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.91.90.62:50002"
  2⤵
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.64.46.27:50002"
  2⤵
  PID:7192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.47.61.83:50002"
  2⤵
  PID:7216
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "118.86.185.36:50002"
  2⤵
  PID:7272
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.3:50002"
  2⤵
  PID:7304
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.99.162.199:50002"
  2⤵
  PID:7328
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "50.35.67.146:50002"
  2⤵
  PID:7372
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "67.205.187.44:50002"
  2⤵
  PID:7412
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.143.214.223:50002"
  2⤵
  PID:7432
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.180.251.11:50002"
  2⤵
  PID:7472
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.77.78:50002"
  2⤵
  PID:7512
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.141.73:50002"
  2⤵
  PID:7552
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.230.24.38:50002"
  2⤵
  PID:7576
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "109.192.105.174:50002"
  2⤵
  PID:7612
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:7632
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.206.105.42:50002"
  2⤵
  PID:7676
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:7732
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "89.58.60.208:50002"
  2⤵
  PID:7772
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.217.32.30:50002"
  2⤵
  PID:7796
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.111:110"
  2⤵
  PID:7832
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "149.56.79.70:50002"
  2⤵
  PID:7896
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "99.199.133.225:50002"
  2⤵
  PID:7944
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:8020
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:8052
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.107:50002"
  2⤵
  PID:8076
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:8132
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.25.36:50002"
  2⤵
  PID:8172
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.222.87:50002"
  2⤵
  PID:5368
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.6:50002"
  2⤵
  PID:7232
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:7248
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:995"
  2⤵
  PID:7316
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.169.69.26:50002"
  2⤵
  PID:7352
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:7420
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "65.21.18.44:50002"
  2⤵
  PID:7544
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:7592
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "77.74.80.179:50002"
  2⤵
  PID:7708
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.208.189.99:50002"
  2⤵
  PID:7804
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.106:50002"
  2⤵
  PID:7792
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "116.202.84.94:50002"
  2⤵
  PID:7964
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "1.2.3.4:50002"
  2⤵
  PID:7960
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.10.251:50002"
  2⤵
  PID:8088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:8160
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.154.223.80:50002"
  2⤵
  PID:6696
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "34.41.139.193:50002"
  2⤵
  PID:7224
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.137.245.3:50002"
  2⤵
  PID:7324
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:7424
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "82.212.38.116:50002"
  2⤵
  PID:7480
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.72.78:50002"
  2⤵
  PID:7608
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.196.113.153:50002"
  2⤵
  PID:7788
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "144.202.14.107:50002"
  2⤵
  PID:7872
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.46.177.74:50002"
  2⤵
  PID:8084
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.116:50002"
  2⤵
  PID:8156
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.181.158:50002"
  2⤵
  PID:7236
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.18.112:50002"
  2⤵
  PID:7336
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "73.116.136.143:50002"
  2⤵
  PID:7548
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.211.185.14:443"
  2⤵
  PID:8036
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "96.27.8.242:50002"
  2⤵
  PID:7924
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "220.233.178.199:50002"
  2⤵
  PID:8028
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50002"
  2⤵
  PID:7392
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "135.181.1.135:50012"
  2⤵
  PID:7596
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.100:50002"
  2⤵
  PID:7684
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.80.67.162:50002"
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "139.162.14.142:50002"
  2⤵
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.64.116.15:50002"
  2⤵
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.79.90.70:50002"
  2⤵
  PID:1276
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "178.32.223.22:50002"
  2⤵
  PID:5720
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.80.227.49:50002"
  2⤵
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.68.251.200:50002"
  2⤵
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "205.197.210.32:50002"
  2⤵
  PID:5860
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.30.215.42:50002"
  2⤵
  PID:6188
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "165.227.22.180:50002"
  2⤵
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.119:50002"
  2⤵
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.120:50002"
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.36.234.239:50002"
  2⤵
  PID:1088
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.37.91.101:50002"
  2⤵
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:6164
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.13.84:50002"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.138.246:50002"
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.174.26.91:50002"
  2⤵
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:920
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.16.182:50002"
  2⤵
  PID:6184
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.183.158.170:50002"
  2⤵
  PID:8228
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "193.58.196.212:50002"
  2⤵
  PID:8260
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.212.32.151:50002"
  2⤵
  PID:8336
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "44.209.47.121:50002"
  2⤵
  PID:8368
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.253.26:50002"
  2⤵
  PID:8412
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "185.181.61.140:50002"
  2⤵
  PID:8468
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.28.117:50002"
  2⤵
  PID:8516
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "188.138.88.42:50002"
  2⤵
  PID:8548
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.212.249.224:50002"
  2⤵
  PID:8588
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.10.11.242:50002"
  2⤵
  PID:8612
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "84.195.61.95:50002"
  2⤵
  PID:8640
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.187.27:50002"
  2⤵
  PID:8688
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "176.31.252.219:50002"
  2⤵
  PID:8716
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.99.212.148:50002"
  2⤵
  PID:8768
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.106.98:50002"
  2⤵
  PID:8808
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.91.74:50002"
  2⤵
  PID:8828
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "2.236.8.149:50002"
  2⤵
  PID:8868
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.6.26:50002"
  2⤵
  PID:8988
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.11.31.76:50002"
  2⤵
  PID:9028
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.249.48.200:50002"
  2⤵
  PID:9048
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.103.153.90:50002"
  2⤵
  PID:9092
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.138.64:50002"
  2⤵
  PID:9124
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:9196
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:1904
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "3.81.142.67:50002"
  2⤵
  PID:5524
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.216.1.145:50002"
  2⤵
  PID:8280
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:8256
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:8404
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:8388
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "213.168.183.227:50002"
  2⤵
  PID:8492
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "76.223.54.146:50002"
  2⤵
  PID:8536
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "13.248.169.48:50002"
  2⤵
  PID:8636
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.4.92.21:50002"
  2⤵
  PID:8664
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.109:50002"
  2⤵
  PID:8728
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.241.196:50002"
  2⤵
  PID:8816
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.198.39.205:50002"
  2⤵
  PID:8840
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.87.37.152:50002"
  2⤵
  PID:8912
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.205.8.78:50002"
  2⤵
  PID:9004
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.86.243.241:50002"
  2⤵
  PID:9104
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.71.109.91:50002"
  2⤵
  PID:9136
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "162.216.16.225:50002"
  2⤵
  PID:9192
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "173.91.90.62:50002"
  2⤵
  PID:812
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "69.64.46.27:50002"
  2⤵
  PID:8276
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.47.61.83:50002"
  2⤵
  PID:8352
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "118.86.185.36:50002"
  2⤵
  PID:8488
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.3:50002"
  2⤵
  PID:8624
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "88.99.162.199:50002"
  2⤵
  PID:8704
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "50.35.67.146:50002"
  2⤵
  PID:8896
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "67.205.187.44:50002"
  2⤵
  PID:9024
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "78.143.214.223:50002"
  2⤵
  PID:9116
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.180.251.11:50002"
  2⤵
  PID:9160
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "51.15.77.78:50002"
  2⤵
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.141.73:50002"
  2⤵
  PID:8208
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "5.230.24.38:50002"
  2⤵
  PID:8620
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "109.192.105.174:50002"
  2⤵
  PID:8528
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:7988
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.206.105.42:50002"
  2⤵
  PID:8112
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "194.55.15.194:50002"
  2⤵
  PID:8756
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "89.58.60.208:50002"
  2⤵
  PID:8776
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "95.217.32.30:50002"
  2⤵
  PID:9012
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.111:110"
  2⤵
  PID:9204
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "149.56.79.70:50002"
  2⤵
  PID:8408
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "99.199.133.225:50002"
  2⤵
  PID:7864
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:5948
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "46.229.238.187:50002"
  2⤵
  PID:8984
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.107:50002"
  2⤵
  PID:8476
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:8108
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "104.21.25.36:50002"
  2⤵
  PID:9008
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "172.67.222.87:50002"
  2⤵
  PID:8732
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.135.194.6:50002"
  2⤵
  PID:9348
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:50002"
  2⤵
  PID:9364
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.104:995"
  2⤵
  PID:9420
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "192.169.69.26:50002"
  2⤵
  PID:9460
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:9520
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "65.21.18.44:50002"
  2⤵
  PID:9544
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "37.187.20.59:50002"
  2⤵
  PID:9572
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "77.74.80.179:50002"
  2⤵
  PID:9620
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "79.208.189.99:50002"
  2⤵
  PID:9660
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.106:50002"
  2⤵
  PID:9700
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "116.202.84.94:50002"
  2⤵
  PID:9748
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "1.2.3.4:50002"
  2⤵
  PID:9772
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "81.7.10.251:50002"
  2⤵
  PID:9844
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "45.154.252.105:50002"
  2⤵
  PID:9884
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "207.154.223.80:50002"
  2⤵
  PID:9924
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "34.41.139.193:50002"
  2⤵
  PID:9980
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "195.137.245.3:50002"
  2⤵
  PID:10020
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "0.0.0.0:50002"
  2⤵
  PID:10064
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "82.212.38.116:50002"
  2⤵
  PID:10100
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "62.210.72.78:50002"
  2⤵
  PID:10140
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "54.196.113.153:50002"
  2⤵
  PID:10160
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe" "144.202.14.107:50002"
  2⤵
  PID:10208

C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.80.67.162:50002"
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "139.162.14.142:50002"
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.64.116.15:50002"
  2⤵
  - Executes dropped EXE
  PID:6068
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.79.90.70:50002"
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "178.32.223.22:50002"
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.80.227.49:50002"
  2⤵
  - Executes dropped EXE
  PID:5652
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.68.251.200:50002"
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "205.197.210.32:50002"
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.30.215.42:50002"
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "165.227.22.180:50002"
  2⤵
  - Executes dropped EXE
  PID:260
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.119:50002"
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.120:50002"
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.36.234.239:50002"
  2⤵
  - Executes dropped EXE
  PID:5852
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.101:50002"
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  - Executes dropped EXE
  PID:5788
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.138.246:50002"
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.174.26.91:50002"
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  - Executes dropped EXE
  PID:5688
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  - Executes dropped EXE
  PID:5984
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.183.158.170:50002"
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "193.58.196.212:50002"
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.212.32.151:50002"
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "44.209.47.121:50002"
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.253.26:50002"
  2⤵
  - Executes dropped EXE
  PID:5644
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.181.61.140:50002"
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.28.117:50002"
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "188.138.88.42:50002"
  2⤵
  - Executes dropped EXE
  PID:6120
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.249.224:50002"
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.10.11.242:50002"
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "84.195.61.95:50002"
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.187.27:50002"
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "176.31.252.219:50002"
  2⤵
  - Executes dropped EXE
  PID:5632
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.99.212.148:50002"
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.106.98:50002"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.91.74:50002"
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "2.236.8.149:50002"
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.6.26:50002"
  2⤵
  - Executes dropped EXE
  PID:6008
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.11.31.76:50002"
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.249.48.200:50002"
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.103.153.90:50002"
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.138.64:50002"
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "3.81.142.67:50002"
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.1.145:50002"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.183.227:50002"
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.109:50002"
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.241.196:50002"
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.39.205:50002"
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.87.37.152:50002"
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.205.8.78:50002"
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.86.243.241:50002"
  2⤵
  - Executes dropped EXE
  PID:5648
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.71.109.91:50002"
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "162.216.16.225:50002"
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.91.90.62:50002"
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.64.46.27:50002"
  2⤵
  PID:2064
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.47.61.83:50002"
  2⤵
  PID:3916
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "118.86.185.36:50002"
  2⤵
  PID:4144
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.3:50002"
  2⤵
  PID:1988
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.99.162.199:50002"
  2⤵
  PID:5324
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "50.35.67.146:50002"
  2⤵
  PID:4520
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "67.205.187.44:50002"
  2⤵
  PID:4580
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.143.214.223:50002"
  2⤵
  PID:4036
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.180.251.11:50002"
  2⤵
  PID:4836
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.77.78:50002"
  2⤵
  PID:4360
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.141.73:50002"
  2⤵
  PID:4884
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.230.24.38:50002"
  2⤵
  PID:5316
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "109.192.105.174:50002"
  2⤵
  PID:5264
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:2432
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.206.105.42:50002"
  2⤵
  PID:1664
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:2812
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "89.58.60.208:50002"
  2⤵
  PID:1620
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.217.32.30:50002"
  2⤵
  PID:3240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.111:110"
  2⤵
  PID:3672
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "149.56.79.70:50002"
  2⤵
  PID:6108
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "99.199.133.225:50002"
  2⤵
  PID:5480
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:5696
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:4924
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.107:50002"
  2⤵
  PID:2244
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:5104
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.25.36:50002"
  2⤵
  PID:4784
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.222.87:50002"
  2⤵
  PID:3304
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.6:50002"
  2⤵
  PID:1896
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:5680
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:995"
  2⤵
  PID:6032
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.169.69.26:50002"
  2⤵
  PID:4220
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:864
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "65.21.18.44:50002"
  2⤵
  PID:5596
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:5768
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "77.74.80.179:50002"
  2⤵
  PID:5508
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.208.189.99:50002"
  2⤵
  PID:2240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.106:50002"
  2⤵
  PID:1092
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "116.202.84.94:50002"
  2⤵
  PID:4260
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "1.2.3.4:50002"
  2⤵
  PID:2608
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.10.251:50002"
  2⤵
  PID:4228
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:1196
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.154.223.80:50002"
  2⤵
  PID:5828
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "34.41.139.193:50002"
  2⤵
  PID:3944
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.137.245.3:50002"
  2⤵
  PID:5092
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:5884
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "82.212.38.116:50002"
  2⤵
  PID:5804
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.72.78:50002"
  2⤵
  PID:2532
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.196.113.153:50002"
  2⤵
  PID:4692
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "144.202.14.107:50002"
  2⤵
  PID:4824
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.46.177.74:50002"
  2⤵
  PID:5564
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.116:50002"
  2⤵
  PID:4312
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.181.158:50002"
  2⤵
  PID:3156
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.18.112:50002"
  2⤵
  PID:6148
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "73.116.136.143:50002"
  2⤵
  PID:6208
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.211.185.14:443"
  2⤵
  PID:6252
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "96.27.8.242:50002"
  2⤵
  PID:6268
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "220.233.178.199:50002"
  2⤵
  PID:6304
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50002"
  2⤵
  PID:6332
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50012"
  2⤵
  PID:6348
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.100:50002"
  2⤵
  PID:6408
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.80.67.162:50002"
  2⤵
  PID:6280
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "139.162.14.142:50002"
  2⤵
  PID:6328
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.64.116.15:50002"
  2⤵
  PID:6416
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.79.90.70:50002"
  2⤵
  PID:4696
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "178.32.223.22:50002"
  2⤵
  PID:6532
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.80.227.49:50002"
  2⤵
  PID:6580
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.68.251.200:50002"
  2⤵
  PID:6616
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "205.197.210.32:50002"
  2⤵
  PID:6676
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.30.215.42:50002"
  2⤵
  PID:6740
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "165.227.22.180:50002"
  2⤵
  PID:6812
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.119:50002"
  2⤵
  PID:6888
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.120:50002"
  2⤵
  PID:6940
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.36.234.239:50002"
  2⤵
  PID:4424
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.101:50002"
  2⤵
  PID:3232
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  PID:4320
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  PID:4964
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  PID:1592
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.138.246:50002"
  2⤵
  PID:4264
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.174.26.91:50002"
  2⤵
  PID:1108
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:3176
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  PID:4760
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.183.158.170:50002"
  2⤵
  PID:3592
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "193.58.196.212:50002"
  2⤵
  PID:4460
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.212.32.151:50002"
  2⤵
  PID:2000
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "44.209.47.121:50002"
  2⤵
  PID:4440
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.253.26:50002"
  2⤵
  PID:4044
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.181.61.140:50002"
  2⤵
  PID:6404
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.28.117:50002"
  2⤵
  PID:6480
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "188.138.88.42:50002"
  2⤵
  PID:6632
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.249.224:50002"
  2⤵
  PID:6576
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.10.11.242:50002"
  2⤵
  PID:6756
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "84.195.61.95:50002"
  2⤵
  PID:6820
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.187.27:50002"
  2⤵
  PID:3124
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "176.31.252.219:50002"
  2⤵
  PID:6140
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.99.212.148:50002"
  2⤵
  PID:5356
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.106.98:50002"
  2⤵
  PID:832
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.91.74:50002"
  2⤵
  PID:892
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "2.236.8.149:50002"
  2⤵
  PID:2440
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.6.26:50002"
  2⤵
  PID:6084
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.11.31.76:50002"
  2⤵
  PID:3636
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.249.48.200:50002"
  2⤵
  PID:4364
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.103.153.90:50002"
  2⤵
  PID:4780
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.138.64:50002"
  2⤵
  PID:432
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:6224
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:5736
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "3.81.142.67:50002"
  2⤵
  PID:6388
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.1.145:50002"
  2⤵
  PID:6064
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  PID:6800
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  PID:6868
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  PID:6996
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.183.227:50002"
  2⤵
  PID:5128
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  PID:3140
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  PID:4108
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  PID:620
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.109:50002"
  2⤵
  PID:3292
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.241.196:50002"
  2⤵
  PID:6436
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.39.205:50002"
  2⤵
  PID:6992
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.87.37.152:50002"
  2⤵
  PID:2620
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.205.8.78:50002"
  2⤵
  PID:1884
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.86.243.241:50002"
  2⤵
  PID:5244
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.71.109.91:50002"
  2⤵
  PID:6596
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "162.216.16.225:50002"
  2⤵
  PID:6928
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.91.90.62:50002"
  2⤵
  PID:5956
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.64.46.27:50002"
  2⤵
  PID:3676
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.47.61.83:50002"
  2⤵
  PID:6384
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "118.86.185.36:50002"
  2⤵
  PID:7172
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.3:50002"
  2⤵
  PID:7240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.99.162.199:50002"
  2⤵
  PID:7252
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "50.35.67.146:50002"
  2⤵
  PID:7296
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "67.205.187.44:50002"
  2⤵
  PID:7360
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.143.214.223:50002"
  2⤵
  PID:7396
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.180.251.11:50002"
  2⤵
  PID:7456
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.77.78:50002"
  2⤵
  PID:7496
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.141.73:50002"
  2⤵
  PID:7532
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.230.24.38:50002"
  2⤵
  PID:7600
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "109.192.105.174:50002"
  2⤵
  PID:7660
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:7692
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.206.105.42:50002"
  2⤵
  PID:7716
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:7760
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "89.58.60.208:50002"
  2⤵
  PID:7812
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.217.32.30:50002"
  2⤵
  PID:7844
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.111:110"
  2⤵
  PID:7876
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "149.56.79.70:50002"
  2⤵
  PID:7912
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "99.199.133.225:50002"
  2⤵
  PID:7936
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:7972
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:7996
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.107:50002"
  2⤵
  PID:8040
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:8100
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.25.36:50002"
  2⤵
  PID:8116
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.222.87:50002"
  2⤵
  PID:8164
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.6:50002"
  2⤵
  PID:8184
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:7204
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:995"
  2⤵
  PID:7264
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.169.69.26:50002"
  2⤵
  PID:7340
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:7464
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "65.21.18.44:50002"
  2⤵
  PID:7444
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:7528
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "77.74.80.179:50002"
  2⤵
  PID:7588
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.208.189.99:50002"
  2⤵
  PID:7688
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.106:50002"
  2⤵
  PID:7748
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "116.202.84.94:50002"
  2⤵
  PID:7768
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "1.2.3.4:50002"
  2⤵
  PID:7868
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.10.251:50002"
  2⤵
  PID:7908
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:7952
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.154.223.80:50002"
  2⤵
  PID:7992
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "34.41.139.193:50002"
  2⤵
  PID:8048
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.137.245.3:50002"
  2⤵
  PID:8148
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:1472
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "82.212.38.116:50002"
  2⤵
  PID:7228
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.72.78:50002"
  2⤵
  PID:7404
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.196.113.153:50002"
  2⤵
  PID:7560
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "144.202.14.107:50002"
  2⤵
  PID:7568
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.46.177.74:50002"
  2⤵
  PID:7724
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.116:50002"
  2⤵
  PID:7852
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.181.158:50002"
  2⤵
  PID:7860
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.18.112:50002"
  2⤵
  PID:7928
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "73.116.136.143:50002"
  2⤵
  PID:8096
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.211.185.14:443"
  2⤵
  PID:7292
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "96.27.8.242:50002"
  2⤵
  PID:7428
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "220.233.178.199:50002"
  2⤵
  PID:7520
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50002"
  2⤵
  PID:7840
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "135.181.1.135:50012"
  2⤵
  PID:7856
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.100:50002"
  2⤵
  PID:6608
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.80.67.162:50002"
  2⤵
  PID:6004
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "139.162.14.142:50002"
  2⤵
  PID:4464
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.64.116.15:50002"
  2⤵
  PID:2540
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.79.90.70:50002"
  2⤵
  PID:5624
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "178.32.223.22:50002"
  2⤵
  PID:4232
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.80.227.49:50002"
  2⤵
  PID:3712
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.68.251.200:50002"
  2⤵
  PID:7620
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "205.197.210.32:50002"
  2⤵
  PID:6020
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.30.215.42:50002"
  2⤵
  PID:6156
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "165.227.22.180:50002"
  2⤵
  PID:6176
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.119:50002"
  2⤵
  PID:2852
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.120:50002"
  2⤵
  PID:3872
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.36.234.239:50002"
  2⤵
  PID:4224
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.37.91.101:50002"
  2⤵
  PID:5600
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  PID:2444
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  PID:6264
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.13.84:50002"
  2⤵
  PID:3188
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.138.246:50002"
  2⤵
  PID:5204
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.174.26.91:50002"
  2⤵
  PID:5744
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:5464
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.16.182:50002"
  2⤵
  PID:4236
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.183.158.170:50002"
  2⤵
  PID:8220
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "193.58.196.212:50002"
  2⤵
  PID:8248
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.212.32.151:50002"
  2⤵
  PID:8288
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "44.209.47.121:50002"
  2⤵
  PID:8312
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.253.26:50002"
  2⤵
  PID:8360
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "185.181.61.140:50002"
  2⤵
  PID:8392
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.28.117:50002"
  2⤵
  PID:8428
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "188.138.88.42:50002"
  2⤵
  PID:8452
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.212.249.224:50002"
  2⤵
  PID:8504
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.10.11.242:50002"
  2⤵
  PID:8540
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "84.195.61.95:50002"
  2⤵
  PID:8572
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.187.27:50002"
  2⤵
  PID:8628
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "176.31.252.219:50002"
  2⤵
  PID:8696
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.99.212.148:50002"
  2⤵
  PID:8736
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.106.98:50002"
  2⤵
  PID:8748
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.91.74:50002"
  2⤵
  PID:8788
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "2.236.8.149:50002"
  2⤵
  PID:8852
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.6.26:50002"
  2⤵
  PID:8888
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.11.31.76:50002"
  2⤵
  PID:8928
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.249.48.200:50002"
  2⤵
  PID:8940
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.103.153.90:50002"
  2⤵
  PID:8968
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.138.64:50002"
  2⤵
  PID:8992
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:9036
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:9060
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "3.81.142.67:50002"
  2⤵
  PID:9108
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.216.1.145:50002"
  2⤵
  PID:9148
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  PID:9180
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  PID:9208
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  PID:2844
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "213.168.183.227:50002"
  2⤵
  PID:7700
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "76.223.54.146:50002"
  2⤵
  PID:8332
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "13.248.169.48:50002"
  2⤵
  PID:8356
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.4.92.21:50002"
  2⤵
  PID:8440
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.109:50002"
  2⤵
  PID:8464
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.241.196:50002"
  2⤵
  PID:8560
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.198.39.205:50002"
  2⤵
  PID:8656
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.87.37.152:50002"
  2⤵
  PID:8708
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.205.8.78:50002"
  2⤵
  PID:8796
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.86.243.241:50002"
  2⤵
  PID:8884
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.71.109.91:50002"
  2⤵
  PID:8924
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "162.216.16.225:50002"
  2⤵
  PID:8980
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "173.91.90.62:50002"
  2⤵
  PID:9076
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "69.64.46.27:50002"
  2⤵
  PID:9164
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.47.61.83:50002"
  2⤵
  PID:2864
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "118.86.185.36:50002"
  2⤵
  PID:8196
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.3:50002"
  2⤵
  PID:8296
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "88.99.162.199:50002"
  2⤵
  PID:8380
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "50.35.67.146:50002"
  2⤵
  PID:8500
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "67.205.187.44:50002"
  2⤵
  PID:8600
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.143.214.223:50002"
  2⤵
  PID:8672
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.180.251.11:50002"
  2⤵
  PID:8860
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "51.15.77.78:50002"
  2⤵
  PID:8916
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.141.73:50002"
  2⤵
  PID:8964
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "5.230.24.38:50002"
  2⤵
  PID:9080
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "109.192.105.174:50002"
  2⤵
  PID:8324
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:8564
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.206.105.42:50002"
  2⤵
  PID:7668
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "194.55.15.194:50002"
  2⤵
  PID:8004
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "89.58.60.208:50002"
  2⤵
  PID:6216
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "95.217.32.30:50002"
  2⤵
  PID:8848
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.111:110"
  2⤵
  PID:9140
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "149.56.79.70:50002"
  2⤵
  PID:2736
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "99.199.133.225:50002"
  2⤵
  PID:8568
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:4444
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "46.229.238.187:50002"
  2⤵
  PID:8976
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.107:50002"
  2⤵
  PID:8240
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:8344
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "104.21.25.36:50002"
  2⤵
  PID:8424
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.222.87:50002"
  2⤵
  PID:8784
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.135.194.6:50002"
  2⤵
  PID:8200
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:50002"
  2⤵
  PID:8684
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.104:995"
  2⤵
  PID:9340
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "192.169.69.26:50002"
  2⤵
  PID:9388
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:9404
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "65.21.18.44:50002"
  2⤵
  PID:9452
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "37.187.20.59:50002"
  2⤵
  PID:9480
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "77.74.80.179:50002"
  2⤵
  PID:9504
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "79.208.189.99:50002"
  2⤵
  PID:9560
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.106:50002"
  2⤵
  PID:9600
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "116.202.84.94:50002"
  2⤵
  PID:9644
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "1.2.3.4:50002"
  2⤵
  PID:9688
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "81.7.10.251:50002"
  2⤵
  PID:9724
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.105:50002"
  2⤵
  PID:9764
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "207.154.223.80:50002"
  2⤵
  PID:9796
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "34.41.139.193:50002"
  2⤵
  PID:9820
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "195.137.245.3:50002"
  2⤵
  PID:9868
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "0.0.0.0:50002"
  2⤵
  PID:9892
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "82.212.38.116:50002"
  2⤵
  PID:9940
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "62.210.72.78:50002"
  2⤵
  PID:9960
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "54.196.113.153:50002"
  2⤵
  PID:10000
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "144.202.14.107:50002"
  2⤵
  PID:10040
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "78.46.177.74:50002"
  2⤵
  PID:10080
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "45.154.252.116:50002"
  2⤵
  PID:10120
- C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
  "C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe" "172.67.181.158:50002"
  2⤵
  PID:10184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HCCa6UDmScEjiHiAbQ.exe

Path C:\Users\Admin\Documents\ZdiVC4UP8k7Z8ZCYjQ\HCCa6UDmScEjiHiAbQ.exe
Size 3.9MB
SHA256 a38e6cdf99edb830eb40a4610a4bf7fccd87447c88da5f0286d57a2f095ec208
MD5 03cb870036b26bdf1240787a96ad1ef0
SHA1 37aa2905eeacf2f0a7981b91adf4b8ef24613e5a
SHA512 7860e633b4dab50522e51966cd28678544b35b25ef1f4405c1d7628b7e875c6393e4e2a72cbf344b434a35102aac683e3a95eb9098c57a695bd7da68336df057
SSDEEP 49152:F0ktHFMh6zvqnvs0+vaO57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTr7c+DNE/l6RROQ+
TLSH
T151168D60FDDB50F9EA03183145ABA27FA33467195335CBC7C7401E9AE86BAE15D33229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2600-4-0x0000000000400000-0x0000000000768000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads