Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 12:08
General
- Target 2026-04-22_4e7583760b036696f8af9c823c87c68a_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260422-pav93set8p
- SHA256 3122241e09904f3f7f78e7501c99d0a872dedb9bb0d527af7ec673af0b6050d5
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 32 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_4e7583760b036696f8af9c823c87c68a_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_4e7583760b036696f8af9c823c87c68a_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4888 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhbzmje.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xrpjhbzmje.exeC:\Temp\xrpjhbzmje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhbzmje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhbzmje.exeC:\Temp\i_xrpjhbzmje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigaytqlj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.exeC:\Temp\qoigaytqlj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigaytqlj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqlj.exeC:\Temp\i_qoigaytqlj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaysicav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nigaysicav.exeC:\Temp\nigaysicav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaysicav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysicav.exeC:\Temp\i_nigaysicav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cavsnlfdxv.exeC:\Temp\cavsnlfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cavsnlfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cavsnlfdxv.exeC:\Temp\i_cavsnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkecwupmhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkecwupmhf.exeC:\Temp\pkecwupmhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkecwupmhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkecwupmhf.exeC:\Temp\i_pkecwupmhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhezxrpbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpbzt.exeC:\Temp\mhezxrpbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhezxrpbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpbzt.exeC:\Temp\i_mhezxrpbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjec.exeC:\Temp\i_jhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqojgby.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\geywqojgby.exeC:\Temp\geywqojgby.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqojgby.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgby.exeC:\Temp\i_geywqojgby.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gbytqljdbv.exe ups_run2⤵
-
C:\Temp\gbytqljdbv.exeC:\Temp\gbytqljdbv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gbytqljdbv.exe ups_ins2⤵
-
C:\Temp\i_gbytqljdbv.exeC:\Temp\i_gbytqljdbv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\lfdyvqoida.exe ups_run2⤵
-
C:\Temp\lfdyvqoida.exeC:\Temp\lfdyvqoida.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_lfdyvqoida.exe ups_ins2⤵
-
C:\Temp\i_lfdyvqoida.exeC:\Temp\i_lfdyvqoida.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run2⤵
-
C:\Temp\fdxvpnifay.exeC:\Temp\fdxvpnifay.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins2⤵
-
C:\Temp\i_fdxvpnifay.exeC:\Temp\i_fdxvpnifay.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fcxvpnhfax.exe ups_run2⤵
-
C:\Temp\fcxvpnhfax.exeC:\Temp\fcxvpnhfax.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fcxvpnhfax.exe ups_ins2⤵
-
C:\Temp\i_fcxvpnhfax.exeC:\Temp\i_fcxvpnhfax.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run2⤵
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins2⤵
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run2⤵
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins2⤵
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run2⤵
-
C:\Temp\hbztrljebw.exeC:\Temp\hbztrljebw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins2⤵
-
C:\Temp\i_hbztrljebw.exeC:\Temp\i_hbztrljebw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run2⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins2⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Temp\ojebwuomge.sysC:\Temp\ojebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbw.sysC:\Temp\gbytrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigsq.sysC:\Temp\gdywqoigsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqlidbvtn.sysC:\Temp\ysqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.sysC:\Temp\nhfaxsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.sysC:\Temp\causmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpkhcam.sysC:\Temp\ezxrpkhcam.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecwupm.sysC:\Temp\usmkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwroj.sysC:\Temp\uomgezwroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytql.sysC:\Temp\wqoigbytql.sys1⤵
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
-
C:\Temp\qkidavtnlf.sysC:\Temp\qkidavtnlf.sys1⤵
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
-
C:\Temp\upnhfaxsqk.sysC:\Temp\upnhfaxsqk.sys1⤵
-
C:\Temp\upkhczusmk.sysC:\Temp\upkhczusmk.sys1⤵
-
C:\Temp\rpjhbzurmk.sysC:\Temp\rpjhbzurmk.sys1⤵
-
C:\Temp\omgezwrojh.sysC:\Temp\omgezwrojh.sys1⤵
-
C:\Temp\trljdbwtom.sysC:\Temp\trljdbwtom.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
causmkfcxv.sys
cavsnlfdxv.exe
eywqojgbzt.exe
ezxrpkhcam.sys
gbytrljdbw.sys
gdywqoigsq.sys
i_cavsnlfdxv.exe
i_eywqojgbzt.exe
i_nigaysicav.exe
i_pkecwupmhf.exe
i_qoigaytqlj.exe
i_rpkhcausmk.exe
i_wqoigaytql.exe
i_xrpjhbzmje.exe
nhfaxsqkic.sys
nigaysicav.exe
ojebwuomge.sys
pkecwupmhf.exe
qoigaytqlj.exe
rpkhcausmk.exe
wqoigaytql.exe
xrpjhbzmje.exe
ysqlidbvtn.sys
suggestions[1].en-US
memory/532-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1324-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1852-157-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2180-104-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2644-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2900-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2904-137-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2988-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3120-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3496-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3944-133-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4000-145-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4112-141-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4304-93-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4788-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5460-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5748-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5984-161-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6088-26-0x0000000000010000-0x0000000000083000-memory.dmp