Sounds like a classic case of malware that’s already in motion. First step: isolate a clean copy of the corrupted system—snapshots, memory dumps, network traffic logs. Then run a static analysis on the binaries; look for suspicious imports, obfuscated sections, or packed payloads. Next, dynamic analysis: sandbox it, watch for API calls, file writes, registry tweaks. If it’s targeting people, there’s probably a pattern—maybe an IP list or a set of identifiers. Once you map out the attack surface, you can patch the vulnerability or rewrite the offending code. Keep the environment strictly controlled; no accidental spread. If you hand me the dump, I can dive deeper right away.

Got the dump, seal the lab, and lock that choke point. Let’s dissect it, patch the core, and shut it down. Ready when you are.

Alright, start pulling the memory image and the network logs. I’ll line up the static analysis on the binary while you secure the lab perimeter. Let’s lock that choke point and cut the flow.