c3f47c9ba60b84f174e6b1b4720743794253b2e7026efcca4c8eedaa0ae0ea3c

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zapret-win-bundle-master/blockcheck/blockcheck.cmd
Size

194B
MD5

5763cb58e6d9b26d626dc860edf2d964
SHA1

e7a90688360deae0e0f44c2541b0aa392f622766
SHA256

5a2de13b097b1ee482f02052c72c5ed29d1541e139464a98697388f4e90cd998
SHA512

339ef0a577f6f6529d36aead691afe9eede48789908cbf30036f516842d3a100599bb3992c66663b085601e5ef8a4b0179644ba7571e23936ba9f5055d308299

Score

5^/10

discovery

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4432	tasklist.exe
4280	tasklist.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1044	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1044	ping.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
768	grep.exe
768	grep.exe
768	grep.exe
768	grep.exe
3968	grep.exe
3968	grep.exe
3968	grep.exe
3968	grep.exe
4572	grep.exe
4572	grep.exe
4572	grep.exe
4572	grep.exe
264	grep.exe
264	grep.exe
264	grep.exe
264	grep.exe
3584	grep.exe
3584	grep.exe
3584	grep.exe
3584	grep.exe
4908	grep.exe
4908	grep.exe
4908	grep.exe
4908	grep.exe
1280	grep.exe
1280	grep.exe
1280	grep.exe
1280	grep.exe
2916	grep.exe
2916	grep.exe
2916	grep.exe
2916	grep.exe
320	grep.exe
320	grep.exe
320	grep.exe
320	grep.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4036	cygpath.exe
Token: SeBackupPrivilege	4036	cygpath.exe
Token: SeDebugPrivilege	4036	cygpath.exe
Token: SeRestorePrivilege	4320	bash.exe
Token: SeBackupPrivilege	4320	bash.exe
Token: SeDebugPrivilege	4320	bash.exe
Token: SeRestorePrivilege	1252	bash.exe
Token: SeBackupPrivilege	1252	bash.exe
Token: SeDebugPrivilege	1252	bash.exe
Token: SeRestorePrivilege	1252	bash.exe
Token: SeBackupPrivilege	1252	bash.exe
Token: SeDebugPrivilege	1252	bash.exe
Token: SeRestorePrivilege	1904	cygpath.exe
Token: SeBackupPrivilege	1904	cygpath.exe
Token: SeDebugPrivilege	1904	cygpath.exe
Token: SeRestorePrivilege	264	bash.exe
Token: SeBackupPrivilege	264	bash.exe
Token: SeDebugPrivilege	264	bash.exe
Token: SeRestorePrivilege	264	bash.exe
Token: SeBackupPrivilege	264	bash.exe
Token: SeDebugPrivilege	264	bash.exe
Token: SeRestorePrivilege	1144	cygpath.exe
Token: SeBackupPrivilege	1144	cygpath.exe
Token: SeDebugPrivilege	1144	cygpath.exe
Token: SeRestorePrivilege	3616	bash.exe
Token: SeBackupPrivilege	3616	bash.exe
Token: SeDebugPrivilege	3616	bash.exe
Token: SeRestorePrivilege	3616	bash.exe
Token: SeBackupPrivilege	3616	bash.exe
Token: SeDebugPrivilege	3616	bash.exe
Token: SeRestorePrivilege	2952	dirname.exe
Token: SeBackupPrivilege	2952	dirname.exe
Token: SeDebugPrivilege	2952	dirname.exe
Token: SeRestorePrivilege	4688	bash.exe
Token: SeBackupPrivilege	4688	bash.exe
Token: SeDebugPrivilege	4688	bash.exe
Token: SeRestorePrivilege	4688	bash.exe
Token: SeBackupPrivilege	4688	bash.exe
Token: SeDebugPrivilege	4688	bash.exe
Token: SeRestorePrivilege	2400	bash.exe
Token: SeBackupPrivilege	2400	bash.exe
Token: SeDebugPrivilege	2400	bash.exe
Token: SeRestorePrivilege	2400	bash.exe
Token: SeBackupPrivilege	2400	bash.exe
Token: SeDebugPrivilege	2400	bash.exe
Token: SeRestorePrivilege	4772	bash.exe
Token: SeBackupPrivilege	4772	bash.exe
Token: SeDebugPrivilege	4772	bash.exe
Token: SeRestorePrivilege	4772	bash.exe
Token: SeBackupPrivilege	4772	bash.exe
Token: SeDebugPrivilege	4772	bash.exe
Token: SeRestorePrivilege	468	tee.exe
Token: SeBackupPrivilege	468	tee.exe
Token: SeDebugPrivilege	468	tee.exe
Token: SeRestorePrivilege	1364	sh.exe
Token: SeBackupPrivilege	1364	sh.exe
Token: SeDebugPrivilege	1364	sh.exe
Token: SeRestorePrivilege	3128	sh.exe
Token: SeBackupPrivilege	3128	sh.exe
Token: SeDebugPrivilege	3128	sh.exe
Token: SeRestorePrivilege	3128	sh.exe
Token: SeBackupPrivilege	3128	sh.exe
Token: SeDebugPrivilege	3128	sh.exe
Token: SeRestorePrivilege	3028	dirname.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4684	1428	cmd.exe	82
PID 1428 wrote to memory of 4684	1428	cmd.exe	82
PID 4684 wrote to memory of 4036	4684	cmd.exe	83
PID 4684 wrote to memory of 4036	4684	cmd.exe	83
PID 1428 wrote to memory of 3016	1428	cmd.exe	84
PID 1428 wrote to memory of 3016	1428	cmd.exe	84
PID 3016 wrote to memory of 4320	3016	elevator.exe	85
PID 3016 wrote to memory of 4320	3016	elevator.exe	85
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 4320 wrote to memory of 1252	4320	bash.exe	88
PID 1252 wrote to memory of 1904	1252	bash.exe	89
PID 1252 wrote to memory of 1904	1252	bash.exe	89
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 4320 wrote to memory of 264	4320	bash.exe	120
PID 264 wrote to memory of 1144	264	bash.exe	91
PID 264 wrote to memory of 1144	264	bash.exe	91
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 4320 wrote to memory of 3616	4320	bash.exe	92
PID 3616 wrote to memory of 2952	3616	bash.exe	93
PID 3616 wrote to memory of 2952	3616	bash.exe	93
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 4688	4320	bash.exe	94
PID 4320 wrote to memory of 2400	4320	bash.exe	95
PID 4320 wrote to memory of 2400	4320	bash.exe	95
PID 4320 wrote to memory of 2400	4320	bash.exe	95
PID 4320 wrote to memory of 2400	4320	bash.exe	95
PID 4320 wrote to memory of 2400	4320	bash.exe	95
PID 4320 wrote to memory of 2400	4320	bash.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\blockcheck.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe
    ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\tools\elevator.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\..\tools\elevator" ..\cygwin\bin\bash -i "'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
    "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\dirname.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sleep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sleep.exe"
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe"
        7⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4456
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq winws.exe"
        7⤵
        Enumerates processes with tasklist
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3692
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq goodbyedpi.exe"
        7⤵
        Enumerates processes with tasklist
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1032
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe iana.org
        7⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3748
        
        C:\Windows\system32\ping.exe
        
        C:\Windows\system32\ping.exe -4 -n 1 -w 1000 8.8.8.8
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2020
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe iana.org 8.8.8.8
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4860
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe pornhub.com 8.8.8.8
        7⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3972
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe ntc.party 8.8.8.8
        7⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:32
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4856
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe rutracker.org 8.8.8.8
        7⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4700
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe www.torproject.org 8.8.8.8
        7⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tr.exe"
        7⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2196
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe bbc.com 8.8.8.8
        7⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sed.exe"
        7⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\cat.exe"
        7⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe"
        7⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sort.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sort.exe"
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\wc.exe"
        8⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\rm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\rm.exe"
        7⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\uname.exe"
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        8⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\gawk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\gawk.exe"
        9⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\sh.exe"
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\usr\local\bin\curl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\usr\local\bin\curl.exe"
        7⤵
        
        PID:844
  - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/zapret-win-bundle-master/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\bin\tee.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:468

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
57B

MD5
b61dbf9b0eb32ef5ecec360db6973df1

SHA1
3a73a9e6649d6f8b10f136e575cbc2049e296025

SHA256
34d67ff1ffec0d83288bc73bf4036b8c23e1b4d84bc48d70175b2d372b10557e

SHA512
a6e62681b1080989c736eecc288782857add9164e513161a4214bbab75cbed8e7d54663761ea2b915df384f74d2542e65eabbbf4ae161233824e57d7cdeddcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
28B

MD5
2bca117c7ca80d5951636483b6fe1a6b

SHA1
53311b733b86d547c4cd2808c1506b7d1c2e2280

SHA256
a17d0f85df96c0dec8ca5934347045292cb2c3ff090fdb5e081f2a26b6a1d076

SHA512
035be0f5c36235019e182c8c8cd05b5fbabd6b85e8931b579dd0ce65ba6aba35992cf61a603caa738ac8e55fe681fb6504332f8fae7f9be5a2e04d503056a21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig1.txt

Filesize
72B

MD5
19cd2d0221be5ed8a5846c5c833628de

SHA1
def8ef0f7170e79f5d7faf6c677302ef8eccc20e

SHA256
22178bad2786d0776a18d3f9dc9c823329eae33f2d6d94c6ff48cbccb7ff1f27

SHA512
d7e063fc7c8789369def8319b794976217494985d68b70f56ed58c8b5d5042dc4b7f1d40e878d6c620280184fd9df458b4fd6c8f89edc866efb7e3a2254129fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
57B

MD5
ebde8629ceb171cf6f07bb5634e615e2

SHA1
0fa52a303c29eb0f4c11db22b691101ba4ca90dd

SHA256
a4a00f45a69e45786239bd380e579a8ac2e20ba8f5893f2aa416c73b435517f0

SHA512
95af2dc8a4ccea3e34d188517d0b4585b28fc34dbe23dec8ee92af3f89e456ced536245f28a10391774c7eaaa5bafc91bd7ec7536e6489d6e28f8d159b9c9483

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
14B

MD5
33f60dd6ef06bce06340797778c148ae

SHA1
5a5c11a86f5ef0e603a15bc41ad146d583a60a63

SHA256
f9d879ff5b7a606aaff0e6d8f44007b10decd918495ecc688d885d9fe27774af

SHA512
5e3983736a186607fb6a672ce904f7a0184a596ee11bb14d7909f33954d4621e2ef184718a207da3426511ce595e93c392714319c89368a77db651eac6dfc69f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
14B

MD5
84233515f8c3dfb3d3c8104583d3d22a

SHA1
e9049ef4bac7a3bf8847d418784356e6d1b09f02

SHA256
b361db25fd46ea38eca0669ec2326b298a30fed89947303b96d734eb02e08343

SHA512
6174b8aa3a0c314eaee8b20a9483a0462c1f0b74d004f122be4ca52b171c59397713e1d2720947314c52d49f89f72088e60999ed8addd56252c3ab342def29b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
28B

MD5
4e7f727a3da88bb76adac3bebbb155c9

SHA1
bb1ede39224444cbbf7a1f95a752ca54957f56c4

SHA256
311446186a80bb610cafbb6fb5226cfacd1ac39cd3a84aa548df015e4ec7a79b

SHA512
a8ea00beff8d1adffefd41ebb8a777cc238e7376f112ec154a85a309beffd42688767496c5f3cc541030dddd17c421ac2c9dbe128be07163028f2b7f8cdd872f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\dig2.txt

Filesize
72B

MD5
0ac69c0cab59c0250841797fc53d5905

SHA1
3604e09df6a3cad76b0ffe825dfea4a3e61cfed7

SHA256
e7ba625ab5dfc3561e1259a4bab33bc43eb6e999ce1fb3aab14e0cf598fe9b69

SHA512
61e2657e2ee8ab085e35003221380232dfaed498a0e1fd13b0265126ce62f82db852d29fb3b5fe4b94a41af9ebcff197a94165adbba319a4bfc95feb12f3aec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
128B

MD5
734b74ba0049f81df4fa3c4736f7c057

SHA1
4dc53da97f59f85683cc6e9bede7bbcfdc94ae72

SHA256
15c4c3112b930033c4d5b5c491f6a1e88b5a787880366397916ab6bc6b947517

SHA512
a81e24e3762b0ec06490204fb398ba91e3aff2b1b719a083510cfb7c42d9037d5e01777f365a0aaf434055354d7c9737a42fefd73c47c48eb96a29d6610bef5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
185B

MD5
68ad373f20cdd36af32834a7ee37924e

SHA1
b73239fc57c466963cd3533f3240eaf75e5dc85a

SHA256
78f9c86576ea9026b39efd4466539b3c60267c4f400b534582463b005f856e4e

SHA512
ed4ad1eaeadd3e6413703b1ef983bb744c7c5785b35276a9775508ac1aced29d0f958a82958495910047d2bcab5cb893a09147f6f1a94927ae253c5eca69ba63

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
28B

MD5
34728dcc159b2b3157d88bda83f39f7e

SHA1
39c35b23a489137fac8022572581e5b8dba8aa9e

SHA256
42a50a19f3d726050777cb2f4d684b1c08774873348b035254d628d8a01c1be6

SHA512
f73a8677edbae31e12d991ced857c4968b9ec5ebffda46f0bd9a3e3fe6487971830104001660a8686148a8a0857bc3537893cff38219442daf45e94a68f5b6cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\cygwin\tmp\digs.txt

Filesize
56B

MD5
0b86555011d1c18046efb754d34c99be

SHA1
089fb3dbc859c73882633869ddb11194e3896bbb

SHA256
3c39dc27a0772f36697e2005917e864a0fb0e67a8a2ab45aa4642505bbb450dc

SHA512
1bcbfacab6adf874398c9235045a7f8138f1f369af61e09e5ed42ec226c5df654a5027e07d43ad1e4767503a8b6182ab8be83a56ecca8bf1697d0e64c1800f84

Download Submit
memory/264-293-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/264-278-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/264-43-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/264-38-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/264-42-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/468-169-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/468-107-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/768-187-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/768-172-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/796-166-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/796-162-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1032-314-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1032-309-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1144-50-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1144-39-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1144-48-0x0000000100400000-0x000000010040F000-memory.dmp

Filesize
60KB

Download
memory/1252-24-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/1252-29-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1252-12-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/1252-13-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/1252-18-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1252-23-0x00000003FF640000-0x00000003FF663000-memory.dmp

Filesize
140KB

Download
memory/1252-22-0x00000003FF670000-0x00000003FF782000-memory.dmp

Filesize
1.1MB

Download
memory/1252-20-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/1252-25-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Filesize
368KB

Download
memory/1272-223-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1272-215-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1364-206-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1364-118-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1460-189-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1460-193-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1904-31-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/1904-28-0x0000000100400000-0x000000010040F000-memory.dmp

Filesize
60KB

Download
memory/1904-27-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2400-125-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2400-97-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2444-142-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2444-147-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2944-205-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2952-70-0x0000000100400000-0x0000000100412000-memory.dmp

Filesize
72KB

Download
memory/2952-74-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2952-58-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/2952-72-0x00000003FF640000-0x00000003FF663000-memory.dmp

Filesize
140KB

Download
memory/3016-4-0x00007FF6ABA80000-0x00007FF6ABA8D000-memory.dmp

Filesize
52KB

Download
memory/3028-128-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3028-140-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3128-133-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3128-127-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3244-149-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3244-155-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3544-271-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3544-281-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3616-69-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3616-67-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/3616-63-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/3616-57-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3692-287-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3692-268-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3968-207-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/3968-213-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4036-0-0x00007FFB39460000-0x00007FFB39762000-memory.dmp

Filesize
3.0MB

Download
memory/4036-1-0x0000000100400000-0x000000010040F000-memory.dmp

Filesize
60KB

Download
memory/4036-3-0x00007FFB39460000-0x00007FFB39762000-memory.dmp

Filesize
3.0MB

Download
memory/4048-217-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4048-231-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4292-180-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4292-168-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4320-9-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4320-8-0x00000003FF140000-0x00000003FF187000-memory.dmp

Filesize
284KB

Download
memory/4320-10-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4320-11-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4320-106-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4320-7-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Filesize
368KB

Download
memory/4320-6-0x00000003FF640000-0x00000003FF663000-memory.dmp

Filesize
140KB

Download
memory/4320-5-0x00000003FF670000-0x00000003FF782000-memory.dmp

Filesize
1.1MB

Download
memory/4456-265-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4456-233-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4516-247-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4516-237-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4572-238-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4572-262-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4688-90-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4688-84-0x0000000100400000-0x00000001004E3000-memory.dmp

Filesize
908KB

Download
memory/4688-81-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4772-116-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/4772-104-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/5080-160-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download
memory/5080-154-0x00007FFB2A620000-0x00007FFB2A922000-memory.dmp

Filesize
3.0MB

Download