9371b0ebb3c8dca75549a229c33d27e7045f0a5ba6f530a719a4e4b4183ff032

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/blockcheck.cmd
Size 191B
Sample260912-l735eahe55
SHA256 9371b0ebb3c8dca75549a229c33d27e7045f0a5ba6f530a719a4e4b4183ff032
MD5 64211d2221551516178d63ba56556755
SHA1 68d47265b83b81632ff084d282758def0bbb2f3a
SHA512 6e45c3ba797d151cc6e47b876cf63e006e49d5c19798850e5da88deef76a152eb5156882e4c073a03b06b447c4642b4fd77b26252c122e46c6d12910df7fc905
TLSH
T1D8C0123458308A78D7A2DE441577F27C90857491AC418522618AB12DA86DA918E4BDE7
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	wscript.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1780	tasklist.exe
2260	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1400	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4988	cmd.exe
4960	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3984	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3984	ping.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4948	grep.exe
4948	grep.exe
4948	grep.exe
4948	grep.exe
1656	grep.exe
1656	grep.exe
1656	grep.exe
1656	grep.exe
1980	grep.exe
1980	grep.exe
1980	grep.exe
1980	grep.exe
3960	grep.exe
3960	grep.exe
3960	grep.exe
3960	grep.exe
1732	grep.exe
1732	grep.exe
1732	grep.exe
1732	grep.exe
2164	grep.exe
2164	grep.exe
2164	grep.exe
2164	grep.exe
3252	grep.exe
3252	grep.exe
3252	grep.exe
3252	grep.exe
212	grep.exe
212	grep.exe
212	grep.exe
212	grep.exe
4768	grep.exe
4768	grep.exe
4768	grep.exe
4768	grep.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	376	cygpath.exe
Token: SeBackupPrivilege	376	cygpath.exe
Token: SeDebugPrivilege	376	cygpath.exe
Token: SeRestorePrivilege	3064	bash.exe
Token: SeBackupPrivilege	3064	bash.exe
Token: SeDebugPrivilege	3064	bash.exe
Token: SeRestorePrivilege	3524	bash.exe
Token: SeBackupPrivilege	3524	bash.exe
Token: SeDebugPrivilege	3524	bash.exe
Token: SeRestorePrivilege	3524	bash.exe
Token: SeBackupPrivilege	3524	bash.exe
Token: SeDebugPrivilege	3524	bash.exe
Token: SeRestorePrivilege	4764	cygpath.exe
Token: SeBackupPrivilege	4764	cygpath.exe
Token: SeDebugPrivilege	4764	cygpath.exe
Token: SeRestorePrivilege	4572	bash.exe
Token: SeBackupPrivilege	4572	bash.exe
Token: SeDebugPrivilege	4572	bash.exe
Token: SeRestorePrivilege	4572	bash.exe
Token: SeBackupPrivilege	4572	bash.exe
Token: SeDebugPrivilege	4572	bash.exe
Token: SeRestorePrivilege	2472	cygpath.exe
Token: SeBackupPrivilege	2472	cygpath.exe
Token: SeDebugPrivilege	2472	cygpath.exe
Token: SeRestorePrivilege	2892	bash.exe
Token: SeBackupPrivilege	2892	bash.exe
Token: SeDebugPrivilege	2892	bash.exe
Token: SeRestorePrivilege	2892	bash.exe
Token: SeBackupPrivilege	2892	bash.exe
Token: SeDebugPrivilege	2892	bash.exe
Token: SeRestorePrivilege	3512	dirname.exe
Token: SeBackupPrivilege	3512	dirname.exe
Token: SeDebugPrivilege	3512	dirname.exe
Token: SeRestorePrivilege	1180	bash.exe
Token: SeBackupPrivilege	1180	bash.exe
Token: SeDebugPrivilege	1180	bash.exe
Token: SeRestorePrivilege	1180	bash.exe
Token: SeBackupPrivilege	1180	bash.exe
Token: SeDebugPrivilege	1180	bash.exe
Token: SeRestorePrivilege	1096	bash.exe
Token: SeBackupPrivilege	1096	bash.exe
Token: SeDebugPrivilege	1096	bash.exe
Token: SeRestorePrivilege	1096	bash.exe
Token: SeBackupPrivilege	1096	bash.exe
Token: SeDebugPrivilege	1096	bash.exe
Token: SeRestorePrivilege	4344	bash.exe
Token: SeBackupPrivilege	4344	bash.exe
Token: SeDebugPrivilege	4344	bash.exe
Token: SeRestorePrivilege	4344	bash.exe
Token: SeBackupPrivilege	4344	bash.exe
Token: SeDebugPrivilege	4344	bash.exe
Token: SeRestorePrivilege	3600	tee.exe
Token: SeBackupPrivilege	3600	tee.exe
Token: SeDebugPrivilege	3600	tee.exe
Token: SeRestorePrivilege	3096	sh.exe
Token: SeBackupPrivilege	3096	sh.exe
Token: SeDebugPrivilege	3096	sh.exe
Token: SeRestorePrivilege	2244	sh.exe
Token: SeBackupPrivilege	2244	sh.exe
Token: SeDebugPrivilege	2244	sh.exe
Token: SeRestorePrivilege	2244	sh.exe
Token: SeBackupPrivilege	2244	sh.exe
Token: SeDebugPrivilege	2244	sh.exe
Token: SeRestorePrivilege	204	dirname.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4988	4960	cmd.exe	84
PID 4988 wrote to memory of 376	4988	cmd.exe	85
PID 4960 wrote to memory of 1400	4960	cmd.exe	86
PID 1400 wrote to memory of 3064	1400	wscript.exe	87
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3064 wrote to memory of 3524	3064	bash.exe	90
PID 3524 wrote to memory of 4764	3524	bash.exe	91
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 3064 wrote to memory of 4572	3064	bash.exe	92
PID 4572 wrote to memory of 2472	4572	bash.exe	93
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 3064 wrote to memory of 2892	3064	bash.exe	94
PID 2892 wrote to memory of 3512	2892	bash.exe	95
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1180	3064	bash.exe	96
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 1096	3064	bash.exe	97
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 3064 wrote to memory of 4344	3064	bash.exe	98
PID 4344 wrote to memory of 3600	4344	bash.exe	99
PID 1096 wrote to memory of 3096	1096	bash.exe	100
PID 3096 wrote to memory of 2244	3096	sh.exe	101
PID 3096 wrote to memory of 2244	3096	sh.exe	101
PID 2244 wrote to memory of 204	2244	sh.exe	102
PID 3096 wrote to memory of 776	3096	sh.exe	103
PID 3096 wrote to memory of 776	3096	sh.exe	103
PID 3096 wrote to memory of 816	3096	sh.exe	104
PID 3096 wrote to memory of 816	3096	sh.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\blockcheck.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe
    ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- C:\Windows\system32\wscript.exe
  wscript ..\tools\elevator.vbs ..\cygwin\bin\bash -i "'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
    "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:204
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sleep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sleep.exe"
        7⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe"
        7⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2788
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq winws.exe"
        7⤵
        Discovers running processes
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4304
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq goodbyedpi.exe"
        7⤵
        Discovers running processes
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1984
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe iana.org
        7⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:812
        
        C:\Windows\system32\ping.exe
        
        C:\Windows\system32\ping.exe -4 -n 1 -w 1000 8.8.8.8
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4124
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe iana.org 8.8.8.8
        7⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1604
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe pornhub.com 8.8.8.8
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3840
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe ntc.party 8.8.8.8
        7⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1108
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe rutracker.org 8.8.8.8
        7⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4236
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe www.torproject.org 8.8.8.8
        7⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4816
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe bbc.com 8.8.8.8
        7⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe"
        7⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sort.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sort.exe"
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe"
        8⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\rm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\rm.exe"
        7⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe"
        8⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        8⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\gawk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\gawk.exe"
        9⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\usr\local\bin\curl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\usr\local\bin\curl.exe"
        7⤵
        
        PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tee.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dig1.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig1.txt
Size 14B
SHA256 f9d879ff5b7a606aaff0e6d8f44007b10decd918495ecc688d885d9fe27774af
MD5 33f60dd6ef06bce06340797778c148ae
SHA1 5a5c11a86f5ef0e603a15bc41ad146d583a60a63
SHA512 5e3983736a186607fb6a672ce904f7a0184a596ee11bb14d7909f33954d4621e2ef184718a207da3426511ce595e93c392714319c89368a77db651eac6dfc69f
MD5 SHA1 SHA512

Submit Download

dig1.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig1.txt
Size 72B
SHA256 e3cca01f1e7ac5e7d6dec9b5df4d1456f4f33281de0185ff2d8369864f6c8c15
MD5 25430c80b6228e04b16e53e9796cbd92
SHA1 d6d4902eab347977c07118f9fb3a2d05e97cc662
SHA512 cc62420e022e1a69a27bf3422840d035ea200365ae662d867f47afda7a501dcae1c86a7f885320f0ef190a3ccae1be7201e4f7008b53aa9c5ac52283aea3496e
TLSH
T1A5A002FA32BB3488FDA28E0845F23089617221E5E97ADC71E2C9040CA8180567878046
MD5 SHA1 SHA512 TLSH

Submit Download

dig1.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig1.txt
Size 57B
SHA256 7fd4f692fdfc887e9ce5484b5b1298465f13fc119cb95893633ccc3c727a9638
MD5 9037336d0c7ebdcadfe439b9f45ff6b9
SHA1 c9f4409965b35ece63b367b95b172185a1889115
SHA512 df8a1f417db4c45cba77864603fbf73ff7aefb1c6f54026dece0ebe2a63a6ad7c35b0b063508ecd5ddf9d5971a7e063060201327002d0983a7de18ab231b211d
MD5 SHA1 SHA512

Submit Download

dig2.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig2.txt
Size 28B
SHA256 311446186a80bb610cafbb6fb5226cfacd1ac39cd3a84aa548df015e4ec7a79b
MD5 4e7f727a3da88bb76adac3bebbb155c9
SHA1 bb1ede39224444cbbf7a1f95a752ca54957f56c4
SHA512 a8ea00beff8d1adffefd41ebb8a777cc238e7376f112ec154a85a309beffd42688767496c5f3cc541030dddd17c421ac2c9dbe128be07163028f2b7f8cdd872f
MD5 SHA1 SHA512

Submit Download

dig2.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig2.txt
Size 72B
SHA256 faf6640f81f984055f5468059476cadadac57d2f3de1b3419a8eca52e43d0e7f
MD5 a1e7230fd022cdab3676ee7d5c9955b5
SHA1 3d6d3abd772182393b19eb4df7370dfd81f16e6a
SHA512 b3ef225a5c3151cb088d16908678fe65866d2ea7401016e849059075d154fcad36cf7db8e4b50ffba09c966025ef1d34414dda670b8c73af7352843b5fc40a96
TLSH
T165A002FA317F3088FDB24C0885E2348A717222E5CBBAE861E2C8040D2908066F878006
MD5 SHA1 SHA512 TLSH

Submit Download

dig2.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig2.txt
Size 57B
SHA256 861d8a27fe896890338cc618484bb47c65a202a6fd34ad9b78e1d926ae22d3a2
MD5 9976edf4d559a5e27fe34a24733b2e91
SHA1 34f07ba44d34c488f5f210704e21d7523a6ddd91
SHA512 d4bd6c9a2f9cb78854ec88d7158804ba8a0244377cd35f2617c73901c5c6de49cf478cf8b38b33615e5c2c633ab49762cc2c442085471846758fa6ca38ca6f8b
MD5 SHA1 SHA512

Submit Download

digs.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\digs.txt
Size 42B
SHA256 f5a7bf696ef6d09bd8e890a5bec57c42976d28a7d74fb82aee3583021b71337f
MD5 8a66fe77b6c348cff8ad0284ada4effd
SHA1 e56a9a35b6a72ef4d9db7765e01a1193c110d491
SHA512 571dcb3744f72c42eb6694a540baf200cf2c59bb9c5ef6f125ca8de68690c75993058dd5affb7a48f1198a03e3b03742d38ca73a9c450a251ad39eefe96df9ea
MD5 SHA1 SHA512

Submit Download

digs.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\digs.txt
Size 114B
SHA256 c4050811e7088fad065cd5bff6533755a59a85f469e5bc0c4f35ada6ef8cfe9a
MD5 edb413d1a1831b022ff2615ba3e39915
SHA1 5858e620debdbbcdff2982ca0ddb8fc858c4fe05
SHA512 803a3e6d0178f0175929afe95128c8534d9a32fc09530a293f84d2adfa99316e6d8095dfdaf939fe9b9b3dc2db8d4a3761c17f1b9cd6285e7ee9bd8daf7adbdb
TLSH
T19BB012F632BF7994EDA2CE0C41E12048603610D5A477FC64D3D60408B82405574F4102
MD5 SHA1 SHA512 TLSH

Submit Download

digs.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\digs.txt
Size 171B
SHA256 f01f0f229a7ead30f7b970a935b1c5ef36d0c93f3133dcfc7331d861e7f44bc1
MD5 a7cb5e786c6cccc8203e6d3e98849f11
SHA1 efd5c6b98d90fd5b6ecbb0dccb3c85d4be2adfa4
SHA512 515b2804dcaba9ef2c422d1f3b40bc4477f33a5fe0ea58bcc3372a0dc29ca4221861d15007fff66ea60bc077366c4713e30dbc8b7071efdbd3cd21c3bd83a929
TLSH
T17FC04CB92B7BFD98D9D38D08C1A1264451EE20E568F7F8E4D3DA34046C650D5F4FC512
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-128-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/204-126-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/204-119-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/204-124-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/376-0-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/376-3-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/376-1-0x0000000100400000-0x000000010040F000-memory.dmp

Download

memory/776-130-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/776-131-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/776-132-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/776-531-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/816-140-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/816-134-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/816-137-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/1096-117-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1096-89-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1096-110-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/1128-241-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/1128-244-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1128-236-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1180-75-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1180-76-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/1180-80-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/1180-82-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1656-193-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/1656-196-0x00000003FF1D0000-0x00000003FF273000-memory.dmp

Download

memory/1656-191-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1656-194-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1980-230-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1980-225-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/1980-221-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1984-256-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/1984-257-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/1984-255-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2076-139-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2076-141-0x0000000100400000-0x0000000100413000-memory.dmp

Download

memory/2076-145-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2244-123-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2244-116-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2244-122-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2244-118-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2440-165-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2440-152-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2440-163-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2472-44-0x0000000100400000-0x000000010040F000-memory.dmp

Download

memory/2472-36-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2472-46-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2520-219-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2520-217-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2696-148-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2696-147-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2696-150-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2788-222-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2788-224-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2788-220-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2892-53-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2892-63-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/2892-61-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/2892-57-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3064-9-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3064-97-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3064-7-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/3064-5-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/3064-154-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3064-153-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3064-6-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Download

memory/3064-4-0x00000003FF670000-0x00000003FF782000-memory.dmp

Download

memory/3064-10-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3064-8-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3096-233-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/3096-108-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/3096-234-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3096-177-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3096-109-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3512-66-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/3512-54-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3512-64-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/3512-68-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3524-11-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3524-22-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/3524-12-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3524-19-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/3524-21-0x00000003FF670000-0x00000003FF782000-memory.dmp

Download

memory/3524-24-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Download

memory/3524-17-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3524-23-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/3524-25-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3600-173-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/3600-100-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3600-175-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/3684-200-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3684-206-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/3684-210-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3960-243-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/3960-245-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/3960-250-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4148-203-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4148-205-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4148-199-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4304-251-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4304-253-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4304-232-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4344-105-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/4344-107-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4344-101-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4344-96-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4356-182-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4356-180-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4356-179-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4572-35-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4572-37-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4572-43-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4668-192-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4668-184-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4668-189-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4764-28-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4764-18-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4764-26-0x0000000100400000-0x000000010040F000-memory.dmp

Download

memory/4948-162-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/4948-167-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/4948-169-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/4948-172-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download

memory/4948-170-0x00000003FF1D0000-0x00000003FF273000-memory.dmp

Download

memory/4948-166-0x00006FFFFFFF0000-0x0000700000000000-memory.dmp

Download

memory/4948-159-0x00007FFBACC90000-0x00007FFBACF92000-memory.dmp

Download