Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 06:14
General
- Target 2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe
- Size 243KB
- Sample260813-gzbb7sstdw
- SHA256 9c69f8a8bae4e6ab30f7b4a607788946e052c78a316b718aa600a56aa329ed2e
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljdbwu.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bztrljdbwu.exeC:\Temp\bztrljdbwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljdbwu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwu.exeC:\Temp\i_bztrljdbwu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.exeC:\Temp\jdbvtolgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtolgey.exeC:\Temp\i_jdbvtolgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdyv.exeC:\Temp\davtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_davtnlfdyv.exeC:\Temp\i_davtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qkidxvqnig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qkidxvqnig.exeC:\Temp\qkidxvqnig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qkidxvqnig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qkidxvqnig.exeC:\Temp\i_qkidxvqnig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhcwupm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpjhcwupm.exeC:\Temp\xrpjhcwupm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhcwupm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhcwupm.exeC:\Temp\i_xrpjhcwupm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomhezx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomhezx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rojebwuomg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rojebwuomg.exeC:\Temp\rojebwuomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rojebwuomg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rojebwuomg.exeC:\Temp\i_rojebwuomg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgbztrljdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgbztrljdb.exeC:\Temp\mgbztrljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgbztrljdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgbztrljdb.exeC:\Temp\i_mgbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigbytql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqoigbytql.exeC:\Temp\vqoigbytql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigbytql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigbytql.exeC:\Temp\i_vqoigbytql.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run2⤵
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins2⤵
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run2⤵
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins2⤵
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run2⤵
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins2⤵
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxupmhfzxr.exe ups_run2⤵
-
C:\Temp\cxupmhfzxr.exeC:\Temp\cxupmhfzxr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxupmhfzxr.exe ups_ins2⤵
-
C:\Temp\i_cxupmhfzxr.exeC:\Temp\i_cxupmhfzxr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run2⤵
-
C:\Temp\urmkecwuom.exeC:\Temp\urmkecwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins2⤵
-
C:\Temp\i_urmkecwuom.exeC:\Temp\i_urmkecwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmgezwrp.exe ups_run2⤵
-
C:\Temp\zurmgezwrp.exeC:\Temp\zurmgezwrp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmgezwrp.exe ups_ins2⤵
-
C:\Temp\i_zurmgezwrp.exeC:\Temp\i_zurmgezwrp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run2⤵
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins2⤵
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbvtoigb.exe ups_run2⤵
-
C:\Temp\ljdbvtoigb.exeC:\Temp\ljdbvtoigb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbvtoigb.exe ups_ins2⤵
-
C:\Temp\i_ljdbvtoigb.exeC:\Temp\i_ljdbvtoigb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igbqlidbvt.exe ups_run2⤵
-
C:\Temp\igbqlidbvt.exeC:\Temp\igbqlidbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Temp\qoigbytrlj.sysC:\Temp\qoigbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.sysC:\Temp\vtolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkhca.sysC:\Temp\hfzxspkhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicamkecx.sysC:\Temp\pkicamkecx.sys1⤵
- Executes dropped EXE
-
C:\Temp\zupmhfzxrp.sysC:\Temp\zupmhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidbv.sysC:\Temp\gaytqlidbv.sys1⤵
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
-
C:\Temp\spcausmkec.sysC:\Temp\spcausmkec.sys1⤵
-
C:\Temp\nhfzxrpkhc.sysC:\Temp\nhfzxrpkhc.sys1⤵
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
-
C:\Temp\bztrljebwu.sysC:\Temp\bztrljebwu.sys1⤵
-
C:\Temp\eywrojytrl.sysC:\Temp\eywrojytrl.sys1⤵
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
ausmkfcxvp.exe
bvtnlgdyvq.sys
bztrljdbwu.exe
davtnlfdyv.exe
ecwuomhezx.exe
hfzxspkhca.sys
i_ausmkfcxvp.exe
i_bztrljdbwu.exe
i_davtnlfdyv.exe
i_ecwuomhezx.exe
i_jdbvtolgey.exe
i_qkidxvqnig.exe
i_xrpjhcwupm.exe
i_ysqkicavsn.exe
icavsnlfdx.sys
jdbvtolgey.exe
pkicamkecx.sys
qkidxvqnig.exe
qoigbytrlj.sys
vtolgeywqo.sys
xrpjhcwupm.exe
ysqkicavsn.exe
zupmhfzxrp.sys
suggestions[1].en-US
memory/8-124-0x0000000000010000-0x0000000000083000-memory.dmp
memory/176-144-0x0000000000010000-0x0000000000083000-memory.dmp
memory/404-136-0x0000000000010000-0x0000000000083000-memory.dmp
memory/880-132-0x0000000000010000-0x0000000000083000-memory.dmp
memory/988-148-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1340-14-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1388-152-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1620-87-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1712-128-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1848-164-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2556-70-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2592-160-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3492-58-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3704-110-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3932-140-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4332-43-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4444-31-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4504-156-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4704-99-0x0000000000010000-0x0000000000083000-memory.dmp