3a17d7cddfec31925a652e917984c278cb8a1ee68554248ded467696c427e041

Analysis

max time kernel
144s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

zapret-win-bundle-master/blockcheck/blockcheck.cmd
Size

199B
MD5

c8f6ce2373ae8cfcbe070e8347fec6b7
SHA1

6af61c6bacf9a43253071dbf2830022d73f19952
SHA256

c62021151e53f72de851086ce377b13ff7bce291d4d58bcc527cc2be5de6d697
SHA512

e5493c350519cd29c76cb5daef3136f346d6af4050284d582ef395dc2b0e1e037978e5aa05df666fd8eb6bbdaf8f5e746998ced42143891df32d3b8869d5c216

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3684	tasklist.exe
2324	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1684	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1684	ping.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2336	grep.exe
2336	grep.exe
2336	grep.exe
2336	grep.exe
2864	grep.exe
2864	grep.exe
2864	grep.exe
2864	grep.exe
2972	grep.exe
2972	grep.exe
2972	grep.exe
2972	grep.exe
1432	grep.exe
1432	grep.exe
1432	grep.exe
1432	grep.exe
4844	grep.exe
4844	grep.exe
4844	grep.exe
4844	grep.exe
2388	grep.exe
2388	grep.exe
2388	grep.exe
2388	grep.exe
4600	grep.exe
4600	grep.exe
4600	grep.exe
4600	grep.exe
3972	grep.exe
3972	grep.exe
3972	grep.exe
3972	grep.exe
2708	grep.exe
2708	grep.exe
2708	grep.exe
2708	grep.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3700	cygpath.exe
Token: SeBackupPrivilege	3700	cygpath.exe
Token: SeDebugPrivilege	3700	cygpath.exe
Token: SeRestorePrivilege	1812	bash.exe
Token: SeBackupPrivilege	1812	bash.exe
Token: SeDebugPrivilege	1812	bash.exe
Token: SeRestorePrivilege	4396	bash.exe
Token: SeBackupPrivilege	4396	bash.exe
Token: SeDebugPrivilege	4396	bash.exe
Token: SeRestorePrivilege	4396	bash.exe
Token: SeBackupPrivilege	4396	bash.exe
Token: SeDebugPrivilege	4396	bash.exe
Token: SeRestorePrivilege	2328	cygpath.exe
Token: SeBackupPrivilege	2328	cygpath.exe
Token: SeDebugPrivilege	2328	cygpath.exe
Token: SeRestorePrivilege	2188	bash.exe
Token: SeBackupPrivilege	2188	bash.exe
Token: SeDebugPrivilege	2188	bash.exe
Token: SeRestorePrivilege	2188	bash.exe
Token: SeBackupPrivilege	2188	bash.exe
Token: SeDebugPrivilege	2188	bash.exe
Token: SeRestorePrivilege	1504	cygpath.exe
Token: SeBackupPrivilege	1504	cygpath.exe
Token: SeDebugPrivilege	1504	cygpath.exe
Token: SeRestorePrivilege	4632	bash.exe
Token: SeBackupPrivilege	4632	bash.exe
Token: SeDebugPrivilege	4632	bash.exe
Token: SeRestorePrivilege	4632	bash.exe
Token: SeBackupPrivilege	4632	bash.exe
Token: SeDebugPrivilege	4632	bash.exe
Token: SeRestorePrivilege	1264	dirname.exe
Token: SeBackupPrivilege	1264	dirname.exe
Token: SeDebugPrivilege	1264	dirname.exe
Token: SeRestorePrivilege	4544	bash.exe
Token: SeBackupPrivilege	4544	bash.exe
Token: SeDebugPrivilege	4544	bash.exe
Token: SeRestorePrivilege	4544	bash.exe
Token: SeBackupPrivilege	4544	bash.exe
Token: SeDebugPrivilege	4544	bash.exe
Token: SeRestorePrivilege	4596	bash.exe
Token: SeBackupPrivilege	4596	bash.exe
Token: SeDebugPrivilege	4596	bash.exe
Token: SeRestorePrivilege	4596	bash.exe
Token: SeBackupPrivilege	4596	bash.exe
Token: SeDebugPrivilege	4596	bash.exe
Token: SeRestorePrivilege	4940	bash.exe
Token: SeBackupPrivilege	4940	bash.exe
Token: SeDebugPrivilege	4940	bash.exe
Token: SeRestorePrivilege	4940	bash.exe
Token: SeBackupPrivilege	4940	bash.exe
Token: SeDebugPrivilege	4940	bash.exe
Token: SeRestorePrivilege	856	tee.exe
Token: SeBackupPrivilege	856	tee.exe
Token: SeDebugPrivilege	856	tee.exe
Token: SeRestorePrivilege	1772	sh.exe
Token: SeBackupPrivilege	1772	sh.exe
Token: SeDebugPrivilege	1772	sh.exe
Token: SeRestorePrivilege	2164	sh.exe
Token: SeBackupPrivilege	2164	sh.exe
Token: SeDebugPrivilege	2164	sh.exe
Token: SeRestorePrivilege	2164	sh.exe
Token: SeBackupPrivilege	2164	sh.exe
Token: SeDebugPrivilege	2164	sh.exe
Token: SeRestorePrivilege	4700	dirname.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4840	4184	cmd.exe	85
PID 4184 wrote to memory of 4840	4184	cmd.exe	85
PID 4840 wrote to memory of 3700	4840	cmd.exe	86
PID 4840 wrote to memory of 3700	4840	cmd.exe	86
PID 4184 wrote to memory of 2740	4184	cmd.exe	87
PID 4184 wrote to memory of 2740	4184	cmd.exe	87
PID 2740 wrote to memory of 1812	2740	wscript.exe	88
PID 2740 wrote to memory of 1812	2740	wscript.exe	88
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 1812 wrote to memory of 4396	1812	bash.exe	91
PID 4396 wrote to memory of 2328	4396	bash.exe	92
PID 4396 wrote to memory of 2328	4396	bash.exe	92
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 1812 wrote to memory of 2188	1812	bash.exe	93
PID 2188 wrote to memory of 1504	2188	bash.exe	94
PID 2188 wrote to memory of 1504	2188	bash.exe	94
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 1812 wrote to memory of 4632	1812	bash.exe	95
PID 4632 wrote to memory of 1264	4632	bash.exe	96
PID 4632 wrote to memory of 1264	4632	bash.exe	96
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4544	1812	bash.exe	97
PID 1812 wrote to memory of 4596	1812	bash.exe	98
PID 1812 wrote to memory of 4596	1812	bash.exe	98
PID 1812 wrote to memory of 4596	1812	bash.exe	98
PID 1812 wrote to memory of 4596	1812	bash.exe	98
PID 1812 wrote to memory of 4596	1812	bash.exe	98
PID 1812 wrote to memory of 4596	1812	bash.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\blockcheck.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe
    ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\Windows\system32\wscript.exe
  wscript ..\tools\elevator.vbs ..\cygwin\bin\bash -i "'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
    "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sleep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sleep.exe"
        7⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe"
        7⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2712
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq winws.exe"
        7⤵
        Enumerates processes with tasklist
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4276
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq goodbyedpi.exe"
        7⤵
        Enumerates processes with tasklist
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2492
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe w3.org
        7⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3972
        
        C:\Windows\system32\ping.exe
        
        C:\Windows\system32\ping.exe -4 -n 1 -w 1000 8.8.8.8
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3256
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe w3.org 8.8.8.8
        7⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4692
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe pornhub.com 8.8.8.8
        7⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1540
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe ntc.party 8.8.8.8
        7⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3884
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe rutracker.org 8.8.8.8
        7⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4048
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe www.torproject.org 8.8.8.8
        7⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4976
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe bbc.com 8.8.8.8
        7⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe"
        7⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sort.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sort.exe"
        8⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe"
        8⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\rm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\rm.exe"
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe"
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\gawk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\gawk.exe"
        9⤵
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\usr\local\bin\curl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\usr\local\bin\curl.exe"
        7⤵
        
        PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tee.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
14B

MD5
33f60dd6ef06bce06340797778c148ae

SHA1
5a5c11a86f5ef0e603a15bc41ad146d583a60a63

SHA256
f9d879ff5b7a606aaff0e6d8f44007b10decd918495ecc688d885d9fe27774af

SHA512
5e3983736a186607fb6a672ce904f7a0184a596ee11bb14d7909f33954d4621e2ef184718a207da3426511ce595e93c392714319c89368a77db651eac6dfc69f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
28B

MD5
2bca117c7ca80d5951636483b6fe1a6b

SHA1
53311b733b86d547c4cd2808c1506b7d1c2e2280

SHA256
a17d0f85df96c0dec8ca5934347045292cb2c3ff090fdb5e081f2a26b6a1d076

SHA512
035be0f5c36235019e182c8c8cd05b5fbabd6b85e8931b579dd0ce65ba6aba35992cf61a603caa738ac8e55fe681fb6504332f8fae7f9be5a2e04d503056a21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
72B

MD5
66cf45f1340ca0a942a4c6335068aa19

SHA1
46227a728c868ca240fcbbd9cd5524327dca6372

SHA256
25d99044b45d5b82c3c9b036f1a40b2a7dcb848676a083ff53284d64ad285717

SHA512
aa2c4af0fe37a2fd6008f3d6f641a5b46f8c8290d044a4e7469eb0c82e1e590c284b0dc91e70bdd7e8111d389f625f2653291423aa0948dcf0b2b0dbafc7b68d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
57B

MD5
6cac2e7b99dbb1a1d56dbba546b3b23e

SHA1
0bbaa27de53da67b81a3a3304d557662846a8881

SHA256
49092498ef25216532b8ac0d5b2b260619d7df4863fcd3566d548d46608a7225

SHA512
e4a47887f6f9eafdd8bfd489eb6ffd8d8b7e89af5781693c2899bdac6f173fa1bd585b119c91299e0b1ac2f6d4193850b005291a2a5e709ea25e06be7033648c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
29B

MD5
451515decf5943337e80b31564731d14

SHA1
8ffe53b5afaad1e3da608ad6b5fb72e1f0d3d989

SHA256
b4a38d5e7d7b616c5c79dff39b5160e02c3d38b7117d93b51abd66a64093ce5f

SHA512
653a0acea319c7d70e5dea5999bfaf33238cb79de11e2de28975cb80f632612952750dc950b92a5e908ee9d65c0a50d27b3d8c247e7122654cf03b74f19e8d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
28B

MD5
4e7f727a3da88bb76adac3bebbb155c9

SHA1
bb1ede39224444cbbf7a1f95a752ca54957f56c4

SHA256
311446186a80bb610cafbb6fb5226cfacd1ac39cd3a84aa548df015e4ec7a79b

SHA512
a8ea00beff8d1adffefd41ebb8a777cc238e7376f112ec154a85a309beffd42688767496c5f3cc541030dddd17c421ac2c9dbe128be07163028f2b7f8cdd872f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
72B

MD5
94ca67cedce4d36646354dbd90b750a0

SHA1
a33f17cb4e5d45708bea75b51c516238117209e0

SHA256
0283c368ba711edf04800dc675abeb5d8d8b94bfd4ed0a7f423f239f54a3de03

SHA512
f76c3e1a479c6033be31fbcec37311d0095f0614a3b9913d0cb516a61f16ba84a8b48f82d4cf2ac16c60483e2a54aac99cafa451f89eb21f60b48e19040e623f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
57B

MD5
b8a0cd44d8db08c20524efc6851da449

SHA1
0cc1c90c41b4c31449eac4b099c9011786e621bb

SHA256
d19f30a3a16fd31c48b5084699f723df2371214dee12426bd7b71ce6a362ee5a

SHA512
8ae95ddad48f9d2c319d9be86f2eef0f88d52ff70a073640195c9c79921103b31d6c1e10d4961f15b07f55068c5887e1b143b471e9712325fca0c4e8381184f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
200B

MD5
3a32117095e0fdaaeb2475d8ba3c9d67

SHA1
7ac0da4efd418d563c5258c37633ebb05b230010

SHA256
d718ba71a2621946270d05f1a501031e6ca4cb31f674c1d0bd63512d5ccd3f63

SHA512
b1a60a212d2bb7a114f40a306a811490f1b23bad6816cf798aced4957ff89904de64aa9e193d92c989d4ed28d0236bfa47abdcdb4d2452b50c188941860b180f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
43B

MD5
ee33e68ebd328cdb782fced6d07d4141

SHA1
0ddd5195640607f989eab3c56ba77343621ff1c7

SHA256
317daff8f205727612be75db33d01f6ff10ac1e0ea7515f9895d81366c4a046a

SHA512
b71fcdf2422ea44998c24e55ab320af9ced4778639721a62e1ebf8966ccf1251493668b184665ee0132649da58854fa67792e5c5031b11cb2b9329257d43cda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
71B

MD5
25cd68deb7ad1e03d009030f24f43db2

SHA1
6b74528de267892a192067c53daeff4f412fef50

SHA256
3b41d486669dba0300215bb9be42f57e4dc5412ff45b2f55c173d62f9a442c17

SHA512
d561461ff58f54b45746dd35e5d2a2af8ebb1d54a461203b7f3d48ac7c33554129d1c3a5b85da8ff8c7e547eccd4b6aaf140030805ded18cba309077da9130ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
143B

MD5
9983508ec8b95a5dca5d6b73984c815f

SHA1
20dbd0b19c9b6c591fbaff2c4dfd46faa36c6447

SHA256
159596c56f739f41a54ae67be86efcf99830df9e31650ca7ecfb5da226723dd9

SHA512
94e7130704c722b6508786d9d568fafbea0124c44b4940994b5e883945f77d7d4376af1a7ee9f4c639198d1e059a395c5d8246a21c2677d8ace53e6d38ccedfa

Download Submit
memory/856-107-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/856-171-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1212-147-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1212-142-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1264-58-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1264-70-0x0000000100400000-0x0000000100412000-memory.dmp

Filesize
72KB

Download
memory/1264-72-0x00000003FF640000-0x00000003FF663000-memory.dmp

Filesize
140KB

Download
memory/1264-74-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1432-280-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1432-265-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1476-150-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1476-160-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1504-50-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1504-38-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1504-48-0x0000000100400000-0x000000010040F000-memory.dmp

Filesize
60KB

Download
memory/1540-208-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1540-196-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1772-124-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1772-195-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1812-5-0x00000003FF640000-0x00000003FF663000-memory.dmp

Filesize
140KB

Download
memory/1812-7-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/1812-6-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Filesize
368KB

Download
memory/1812-4-0x00000003FF670000-0x00000003FF782000-memory.dmp

Filesize
1.1MB

Download
memory/1812-8-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/1812-9-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/1812-10-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/1812-106-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2164-135-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2164-127-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2188-47-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2188-37-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2188-41-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/2232-162-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2232-166-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2328-20-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2328-28-0x0000000100400000-0x000000010040F000-memory.dmp

Filesize
60KB

Download
memory/2328-30-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2336-172-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2336-187-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2492-291-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2492-288-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2712-247-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2712-232-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2864-214-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2864-199-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2972-255-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/2972-241-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3644-216-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3644-223-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3660-193-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3660-189-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3700-0-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3700-3-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/3700-1-0x0000000100400000-0x000000010040F000-memory.dmp

Filesize
60KB

Download
memory/4276-279-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4276-257-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4296-168-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4296-181-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4384-149-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4384-155-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4396-26-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Filesize
368KB

Download
memory/4396-25-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/4396-27-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4396-23-0x00000003FF670000-0x00000003FF782000-memory.dmp

Filesize
1.1MB

Download
memory/4396-24-0x00000003FF640000-0x00000003FF663000-memory.dmp

Filesize
140KB

Download
memory/4396-17-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4396-11-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4396-12-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4396-21-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4544-81-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4544-88-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/4544-84-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4544-90-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4564-244-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4564-235-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4596-125-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4596-97-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4632-69-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4632-67-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/4632-63-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4632-57-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4700-132-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4700-140-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4824-218-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4824-230-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4940-116-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/4940-104-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/5000-260-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download
memory/5000-269-0x00007FFF155C0000-0x00007FFF158C2000-memory.dmp

Filesize
3.0MB

Download