9371b0ebb3c8dca75549a229c33d27e7045f0a5ba6f530a719a4e4b4183ff032

Analysis

max time kernel
149s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/blockcheck.cmd
Size 191B
Sample260912-l735eahe55
SHA256 9371b0ebb3c8dca75549a229c33d27e7045f0a5ba6f530a719a4e4b4183ff032
MD5 64211d2221551516178d63ba56556755
SHA1 68d47265b83b81632ff084d282758def0bbb2f3a
SHA512 6e45c3ba797d151cc6e47b876cf63e006e49d5c19798850e5da88deef76a152eb5156882e4c073a03b06b447c4642b4fd77b26252c122e46c6d12910df7fc905
TLSH
T1D8C0123458308A78D7A2DE441577F27C90857491AC418522618AB12DA86DA918E4BDE7
MD5 SHA1 SHA512 TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3372	tasklist.exe
2680	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5884	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2004	cmd.exe
1944	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6012	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6012	ping.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2944	grep.exe
2944	grep.exe
2944	grep.exe
2944	grep.exe
956	grep.exe
956	grep.exe
956	grep.exe
956	grep.exe
3160	grep.exe
3160	grep.exe
3160	grep.exe
3160	grep.exe
2272	grep.exe
2272	grep.exe
2272	grep.exe
2272	grep.exe
4360	grep.exe
4360	grep.exe
4360	grep.exe
4360	grep.exe
4108	grep.exe
4108	grep.exe
4108	grep.exe
4108	grep.exe
4524	grep.exe
4524	grep.exe
4524	grep.exe
4524	grep.exe
1576	grep.exe
1576	grep.exe
1576	grep.exe
1576	grep.exe
4296	grep.exe
4296	grep.exe
4296	grep.exe
4296	grep.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3900	cygpath.exe
Token: SeBackupPrivilege	3900	cygpath.exe
Token: SeDebugPrivilege	3900	cygpath.exe
Token: SeRestorePrivilege	4140	bash.exe
Token: SeBackupPrivilege	4140	bash.exe
Token: SeDebugPrivilege	4140	bash.exe
Token: SeRestorePrivilege	4604	bash.exe
Token: SeBackupPrivilege	4604	bash.exe
Token: SeDebugPrivilege	4604	bash.exe
Token: SeRestorePrivilege	4604	bash.exe
Token: SeBackupPrivilege	4604	bash.exe
Token: SeDebugPrivilege	4604	bash.exe
Token: SeRestorePrivilege	4320	cygpath.exe
Token: SeBackupPrivilege	4320	cygpath.exe
Token: SeDebugPrivilege	4320	cygpath.exe
Token: SeRestorePrivilege	5732	bash.exe
Token: SeBackupPrivilege	5732	bash.exe
Token: SeDebugPrivilege	5732	bash.exe
Token: SeRestorePrivilege	5732	bash.exe
Token: SeBackupPrivilege	5732	bash.exe
Token: SeDebugPrivilege	5732	bash.exe
Token: SeRestorePrivilege	4532	cygpath.exe
Token: SeBackupPrivilege	4532	cygpath.exe
Token: SeDebugPrivilege	4532	cygpath.exe
Token: SeRestorePrivilege	4232	bash.exe
Token: SeBackupPrivilege	4232	bash.exe
Token: SeDebugPrivilege	4232	bash.exe
Token: SeRestorePrivilege	4232	bash.exe
Token: SeBackupPrivilege	4232	bash.exe
Token: SeDebugPrivilege	4232	bash.exe
Token: SeRestorePrivilege	1748	dirname.exe
Token: SeBackupPrivilege	1748	dirname.exe
Token: SeDebugPrivilege	1748	dirname.exe
Token: SeRestorePrivilege	2724	bash.exe
Token: SeBackupPrivilege	2724	bash.exe
Token: SeDebugPrivilege	2724	bash.exe
Token: SeRestorePrivilege	2724	bash.exe
Token: SeBackupPrivilege	2724	bash.exe
Token: SeDebugPrivilege	2724	bash.exe
Token: SeRestorePrivilege	5028	bash.exe
Token: SeBackupPrivilege	5028	bash.exe
Token: SeDebugPrivilege	5028	bash.exe
Token: SeRestorePrivilege	5028	bash.exe
Token: SeBackupPrivilege	5028	bash.exe
Token: SeDebugPrivilege	5028	bash.exe
Token: SeRestorePrivilege	5712	bash.exe
Token: SeBackupPrivilege	5712	bash.exe
Token: SeDebugPrivilege	5712	bash.exe
Token: SeRestorePrivilege	5712	bash.exe
Token: SeBackupPrivilege	5712	bash.exe
Token: SeDebugPrivilege	5712	bash.exe
Token: SeRestorePrivilege	292	tee.exe
Token: SeBackupPrivilege	292	tee.exe
Token: SeDebugPrivilege	292	tee.exe
Token: SeRestorePrivilege	4104	sh.exe
Token: SeBackupPrivilege	4104	sh.exe
Token: SeDebugPrivilege	4104	sh.exe
Token: SeRestorePrivilege	2280	sh.exe
Token: SeBackupPrivilege	2280	sh.exe
Token: SeDebugPrivilege	2280	sh.exe
Token: SeRestorePrivilege	2280	sh.exe
Token: SeBackupPrivilege	2280	sh.exe
Token: SeDebugPrivilege	2280	sh.exe
Token: SeRestorePrivilege	3916	dirname.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1944	2004	cmd.exe	89
PID 1944 wrote to memory of 3900	1944	cmd.exe	90
PID 2004 wrote to memory of 5884	2004	cmd.exe	91
PID 5884 wrote to memory of 4140	5884	wscript.exe	92
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4140 wrote to memory of 4604	4140	bash.exe	94
PID 4604 wrote to memory of 4320	4604	bash.exe	95
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 4140 wrote to memory of 5732	4140	bash.exe	96
PID 5732 wrote to memory of 4532	5732	bash.exe	97
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4140 wrote to memory of 4232	4140	bash.exe	98
PID 4232 wrote to memory of 1748	4232	bash.exe	99
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 2724	4140	bash.exe	100
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5028	4140	bash.exe	101
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 4140 wrote to memory of 5712	4140	bash.exe	102
PID 5712 wrote to memory of 292	5712	bash.exe	103
PID 5028 wrote to memory of 4104	5028	bash.exe	104
PID 4104 wrote to memory of 2280	4104	sh.exe	105
PID 4104 wrote to memory of 2280	4104	sh.exe	105
PID 2280 wrote to memory of 3916	2280	sh.exe	106
PID 4104 wrote to memory of 4768	4104	sh.exe	107
PID 4104 wrote to memory of 4768	4104	sh.exe	107
PID 4104 wrote to memory of 6020	4104	sh.exe	108
PID 4104 wrote to memory of 6020	4104	sh.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\blockcheck.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe
    ..\cygwin\bin\cygpath -C OEM -a -m zapret\blog.sh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\Windows\system32\wscript.exe
  wscript ..\tools\elevator.vbs ..\cygwin\bin\bash -i "'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
    "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cygpath.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\dirname.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sleep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sleep.exe"
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe"
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3696
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq winws.exe"
        7⤵
        Discovers running processes
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5912
        
        C:\Windows\system32\tasklist.exe
        
        C:\Windows\system32\tasklist.exe /NH /FI "IMAGENAME eq goodbyedpi.exe"
        7⤵
        Discovers running processes
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4180
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe iana.org
        7⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5560
        
        C:\Windows\system32\ping.exe
        
        C:\Windows\system32\ping.exe -4 -n 1 -w 1000 8.8.8.8
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1092
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe iana.org 8.8.8.8
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:256
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3752
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe pornhub.com 8.8.8.8
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3964
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe ntc.party 8.8.8.8
        7⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1004
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe rutracker.org 8.8.8.8
        7⤵
        
        PID:248
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5272
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe www.torproject.org 8.8.8.8
        7⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\blockcheck\zapret\mdig\mdig.exe --family=4
        7⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tr.exe"
        7⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\readlink.exe"
        7⤵
        
        PID:260
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3308
        
        C:\Windows\system32\nslookup.exe
        
        C:\Windows\system32\nslookup.exe bbc.com 8.8.8.8
        7⤵
        
        PID:248
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sed.exe"
        7⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\grep.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\cat.exe"
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe"
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sort.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sort.exe"
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\wc.exe"
        8⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\rm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\rm.exe"
        7⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\uname.exe"
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        7⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\gawk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\gawk.exe"
        9⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\sh.exe"
        6⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\usr\local\bin\curl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\usr\local\bin\curl.exe"
        7⤵
        
        PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe
      "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\bash.exe" -i 'C:/Users/Admin/AppData/Local/Temp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\bin\tee.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dig1.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig1.txt
Size 28B
SHA256 311446186a80bb610cafbb6fb5226cfacd1ac39cd3a84aa548df015e4ec7a79b
MD5 4e7f727a3da88bb76adac3bebbb155c9
SHA1 bb1ede39224444cbbf7a1f95a752ca54957f56c4
SHA512 a8ea00beff8d1adffefd41ebb8a777cc238e7376f112ec154a85a309beffd42688767496c5f3cc541030dddd17c421ac2c9dbe128be07163028f2b7f8cdd872f
MD5 SHA1 SHA512

Submit Download

dig1.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig1.txt
Size 72B
SHA256 651bcb032a10c22de8501fe5530733fac5f05aeac8b2254c1222c593ffd6f40f
MD5 47ee16235d4269bf15a694f8a356bc00
SHA1 f2cbed08e5d5eb08f1a7bb53b5093eeca60cf0ab
SHA512 8c56402f4e3f2e963a0a8549deb4abac7ce766217e54237c628e9d3b81d23b6e84dc806d95f4ec767a4a49c83469df6d5e315a8a5921663a6c0c0c18b29ac46b
TLSH
T192A002FF32BB3488FDA28D0945F23089A0B221E5E87ADC61E2C9040CA8190567878046
MD5 SHA1 SHA512 TLSH

Submit Download

dig1.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig1.txt
Size 57B
SHA256 04fd577c73626a9ee235778c208a48102cc2cfaec24476d39526e2374e890380
MD5 4426baf604ba4da14ed08612cdfe1c3e
SHA1 b3da98049be3eb0efd4e7eec3d42afabdc360ea2
SHA512 0864021e71d406fd6b70c5737184e9360c883763eddfe2814cc76bea10cc176147a8cf533ed7657059166f05a6f9a72ad7569a2d05fdb79c42ce16f1016c789d
MD5 SHA1 SHA512

Submit Download

dig2.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig2.txt
Size 14B
SHA256 f9d879ff5b7a606aaff0e6d8f44007b10decd918495ecc688d885d9fe27774af
MD5 33f60dd6ef06bce06340797778c148ae
SHA1 5a5c11a86f5ef0e603a15bc41ad146d583a60a63
SHA512 5e3983736a186607fb6a672ce904f7a0184a596ee11bb14d7909f33954d4621e2ef184718a207da3426511ce595e93c392714319c89368a77db651eac6dfc69f
MD5 SHA1 SHA512

Submit Download

dig2.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig2.txt
Size 72B
SHA256 25d99044b45d5b82c3c9b036f1a40b2a7dcb848676a083ff53284d64ad285717
MD5 66cf45f1340ca0a942a4c6335068aa19
SHA1 46227a728c868ca240fcbbd9cd5524327dca6372
SHA512 aa2c4af0fe37a2fd6008f3d6f641a5b46f8c8290d044a4e7469eb0c82e1e590c284b0dc91e70bdd7e8111d389f625f2653291423aa0948dcf0b2b0dbafc7b68d
TLSH
T10BA002FA32BF3498FCA28E0845F23089617320E5ED7ADC71E2D9040CA9180567878046
MD5 SHA1 SHA512 TLSH

Submit Download

dig2.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\dig2.txt
Size 57B
SHA256 139be8608149f3a0c24f51330b48467c8d11b28b604d84b21d731a887df3d7b7
MD5 895c068aecc14501c501b9d01a418643
SHA1 611ea64f76222f08f3367ddee9103e407817aa0c
SHA512 4a3edfdd12a0a62e3866bd9de63990196b93d8129e02cf732172aaf27d9a94eb919d6e532ea70e17e5af73c817a4639b3bdf300c0e40a2897111c97ba5303e05
MD5 SHA1 SHA512

Submit Download

digs.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\digs.txt
Size 42B
SHA256 f5a7bf696ef6d09bd8e890a5bec57c42976d28a7d74fb82aee3583021b71337f
MD5 8a66fe77b6c348cff8ad0284ada4effd
SHA1 e56a9a35b6a72ef4d9db7765e01a1193c110d491
SHA512 571dcb3744f72c42eb6694a540baf200cf2c59bb9c5ef6f125ca8de68690c75993058dd5affb7a48f1198a03e3b03742d38ca73a9c450a251ad39eefe96df9ea
MD5 SHA1 SHA512

Submit Download

digs.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\digs.txt
Size 114B
SHA256 cf835bfeb3e578f708c41a13cbbfb136b147aa97eea084298344dc69ce959ea7
MD5 c3d2a49befad5b186f0436387e6a34a3
SHA1 a30fbf05df9963b9951f84ddc3b20db920b6377c
SHA512 7af696d62e3496dc61ce310346d4dfb75a9a595fdcbc9863f3084801f0be7f5490b2810fa00dd7e8b43115705bc62df98e8686ed0f5e203146abb82cbc9e9752
TLSH
T158B012FB32BF7994EDA2CD0C41F12048A07610D5A477FC54D3D60408B82405574F4102
MD5 SHA1 SHA512 TLSH

Submit Download

digs.txt

Path C:\Users\Admin\AppData\Local\Temp\Rus_Games_And_Sites_Unlocker_1-main\Sites-unlocker-rus\bin\cygwin\tmp\digs.txt
Size 171B
SHA256 28fa93c56443c82999314f0a37dc6dbf879d18a48bbbf6c118def5ab72f15e3f
MD5 39b1167773942c8aa9278f67e8fcba06
SHA1 0acd128e362891d6fac95775a83e6029e058d224
SHA512 08969e78cfb645683433df9d2492ae8ecb4ace8aea6a887aae33a124d290123d89ee2766d3630accfaf093fc876d94ea9f60506785ddaeb72576cc817a3ca81e
TLSH
T1C7C002FA2B7BBD98D9938D0981A1264491EE20E564B7F8D4D3DA34046C65095F4E8512
MD5 SHA1 SHA512 TLSH

Submit Download

memory/292-224-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/292-223-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/292-95-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/292-151-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/292-222-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/616-180-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/616-173-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/616-178-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/956-177-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/956-187-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/956-185-0x00000003FF1D0000-0x00000003FF273000-memory.dmp

Download

memory/956-182-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/1748-54-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/1748-57-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/1748-55-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/2272-236-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2272-247-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/2272-252-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2280-118-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2280-115-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2280-114-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/2280-125-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2688-190-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2688-200-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2688-196-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/2724-79-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2724-73-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/2724-77-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/2724-72-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2944-163-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/2944-160-0x00006FFFFFFF0000-0x0000700000000000-memory.dmp

Download

memory/2944-161-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/2944-153-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/2944-156-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/2944-165-0x00000003FF1D0000-0x00000003FF273000-memory.dmp

Download

memory/2944-166-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3160-205-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3160-231-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3160-226-0x0000000100400000-0x0000000100450000-memory.dmp

Download

memory/3240-169-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3240-170-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/3496-144-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3496-134-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3496-140-0x0000000100400000-0x0000000100413000-memory.dmp

Download

memory/3696-213-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/3696-202-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3696-215-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3900-0-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3900-1-0x0000000100400000-0x000000010040F000-memory.dmp

Download

memory/3900-3-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3916-123-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/3916-120-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/3916-121-0x0000000100400000-0x0000000100412000-memory.dmp

Download

memory/3916-126-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4104-106-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4104-168-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4104-105-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4140-94-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4140-10-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4140-4-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4140-5-0x00000003FF670000-0x00000003FF782000-memory.dmp

Download

memory/4140-6-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/4140-8-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/4140-7-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Download

memory/4140-216-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4140-217-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4140-9-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4180-256-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4180-255-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4180-254-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4232-65-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4232-63-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/4232-51-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4232-59-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4276-195-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4276-193-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4276-189-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4320-25-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4320-18-0x0000000100400000-0x000000010040F000-memory.dmp

Download

memory/4532-36-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4532-35-0x0000000100400000-0x000000010040F000-memory.dmp

Download

memory/4536-235-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4536-242-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4536-240-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/4604-23-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/4604-17-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4604-21-0x00000003FF670000-0x00000003FF782000-memory.dmp

Download

memory/4604-19-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4604-12-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4604-27-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4604-22-0x00000003FF640000-0x00000003FF663000-memory.dmp

Download

memory/4604-24-0x00000003FF430000-0x00000003FF48C000-memory.dmp

Download

memory/4604-11-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/4768-131-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4768-128-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/4768-129-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/5028-107-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/5028-113-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5028-86-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5476-259-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5476-258-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/5560-261-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/5560-262-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5608-204-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5608-210-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/5608-212-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5632-157-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/5632-152-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5632-159-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5712-104-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5712-93-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5712-98-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/5712-102-0x00000003FF140000-0x00000003FF187000-memory.dmp

Download

memory/5732-43-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5732-37-0x0000000100400000-0x00000001004E3000-memory.dmp

Download

memory/5732-34-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5912-244-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/5912-233-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/5912-246-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/6008-147-0x0000000100400000-0x0000000100421000-memory.dmp

Download

memory/6008-146-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/6008-149-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/6020-133-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/6020-139-0x00007FFA55D70000-0x00007FFA56072000-memory.dmp

Download

memory/6020-137-0x0000000100400000-0x0000000100421000-memory.dmp

Download