74960b7a5675ac6f49f51f73c4800e73e0788b78e21f5a9741b1e5334bf6b60c

Analysis

max time kernel
66s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files\ZapretTray.exe
Size 91KB
Sample261102-pevt4ss1ds
SHA256 74960b7a5675ac6f49f51f73c4800e73e0788b78e21f5a9741b1e5334bf6b60c
MD5 9c4654ca19c43b00d349328fad06a120
SHA1 fffc88bcd17c6cfcf6b6324ce1b8bc8a60fa37ce
SHA512 54727c4eb9d7f290e918a4b7bf542d6ab1ecadde9af23bac89ee0e999b59307ad7638b0361a2b9831ff426413bbf85f79ac192d47d1e815bf8f8354ddd277f5c
SSDEEP 1536:n4ZJqnK8Dk/2hEKa62iE3u26USITl2dLFwZLw1YYkHOYx3:MEnK8Ds2r2iE3+siFwZLw1YYkuYx
TLSH
T1FE933B4733EC8221E6BF47B8947141910BB2BA53E616EB8C1ECB78DC05B67F14A1539B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
47	3768	curl.exe
49	4148	curl.exe
50	1408	curl.exe
64	4788	curl.exe
69	5760	curl.exe
142	5976	curl.exe
166	4452	curl.exe
202	5976	curl.exe

Contacts third-party web service commonly abused for C2 1 TTPs 28 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
90	discord.com
160	discord.com
200	discord.com
223	discord.com
476	discord.com
54	discord.com
260	discord.com
272	discord.com
389	discord.com
439	discord.com
40	discord.com
104	discord.com
172	discord.com
213	discord.com
246	discord.com
409	discord.com
426	discord.com
460	discord.com
4	discord.com
85	discord.com
125	discord.com
149	discord.com
185	discord.com
236	discord.com
448	discord.com
1	discord.com
65	discord.com
71	discord.com

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1688	sc.exe
2904	sc.exe
5864	sc.exe
5624	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 31 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1680	cmd.exe
968	cmd.exe
5788	cmd.exe
2432	cmd.exe
600	cmd.exe
4924	cmd.exe
1900	cmd.exe
4756	cmd.exe
2136	cmd.exe
2200	cmd.exe
5932	cmd.exe
5876	cmd.exe
2564	cmd.exe
1484	cmd.exe
5760	cmd.exe
5672	cmd.exe
5468	cmd.exe
5264	cmd.exe
4116	cmd.exe
4372	cmd.exe
1884	cmd.exe
4452	cmd.exe
5272	cmd.exe
1896	cmd.exe
4368	cmd.exe
5676	cmd.exe
1604	cmd.exe
4080	cmd.exe
3296	cmd.exe
5380	cmd.exe
3184	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZapretTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZapretTray.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	ZapretTray.exe
Token: SeRestorePrivilege	1484	winws.exe
Token: SeBackupPrivilege	1484	winws.exe
Token: SeDebugPrivilege	1484	winws.exe
Token: SeRestorePrivilege	5932	winws.exe
Token: SeBackupPrivilege	5932	winws.exe
Token: SeDebugPrivilege	5932	winws.exe
Token: SeRestorePrivilege	4376	winws.exe
Token: SeBackupPrivilege	4376	winws.exe
Token: SeDebugPrivilege	4376	winws.exe
Token: SeRestorePrivilege	4812	winws.exe
Token: SeBackupPrivilege	4812	winws.exe
Token: SeDebugPrivilege	4812	winws.exe
Token: SeRestorePrivilege	3420	winws.exe
Token: SeBackupPrivilege	3420	winws.exe
Token: SeDebugPrivilege	3420	winws.exe
Token: SeRestorePrivilege	5008	winws.exe
Token: SeBackupPrivilege	5008	winws.exe
Token: SeDebugPrivilege	5008	winws.exe
Token: SeRestorePrivilege	4640	winws.exe
Token: SeBackupPrivilege	4640	winws.exe
Token: SeDebugPrivilege	4640	winws.exe
Token: SeRestorePrivilege	2004	winws.exe
Token: SeBackupPrivilege	2004	winws.exe
Token: SeDebugPrivilege	2004	winws.exe
Token: SeRestorePrivilege	4072	winws.exe
Token: SeBackupPrivilege	4072	winws.exe
Token: SeDebugPrivilege	4072	winws.exe
Token: SeRestorePrivilege	1112	winws.exe
Token: SeBackupPrivilege	1112	winws.exe
Token: SeDebugPrivilege	1112	winws.exe
Token: SeRestorePrivilege	3552	winws.exe
Token: SeBackupPrivilege	3552	winws.exe
Token: SeDebugPrivilege	3552	winws.exe
Token: SeRestorePrivilege	6048	winws.exe
Token: SeBackupPrivilege	6048	winws.exe
Token: SeDebugPrivilege	6048	winws.exe
Token: SeRestorePrivilege	2836	winws.exe
Token: SeBackupPrivilege	2836	winws.exe
Token: SeDebugPrivilege	2836	winws.exe
Token: SeRestorePrivilege	2556	winws.exe
Token: SeBackupPrivilege	2556	winws.exe
Token: SeDebugPrivilege	2556	winws.exe
Token: SeRestorePrivilege	4492	winws.exe
Token: SeBackupPrivilege	4492	winws.exe
Token: SeDebugPrivilege	4492	winws.exe
Token: SeRestorePrivilege	2436	winws.exe
Token: SeBackupPrivilege	2436	winws.exe
Token: SeDebugPrivilege	2436	winws.exe
Token: SeRestorePrivilege	4788	winws.exe
Token: SeBackupPrivilege	4788	winws.exe
Token: SeDebugPrivilege	4788	winws.exe
Token: SeRestorePrivilege	3804	winws.exe
Token: SeBackupPrivilege	3804	winws.exe
Token: SeDebugPrivilege	3804	winws.exe
Token: SeRestorePrivilege	2560	winws.exe
Token: SeBackupPrivilege	2560	winws.exe
Token: SeDebugPrivilege	2560	winws.exe
Token: SeRestorePrivilege	1768	winws.exe
Token: SeBackupPrivilege	1768	winws.exe
Token: SeDebugPrivilege	1768	winws.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe
4896	ZapretTray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1688	4896	ZapretTray.exe	89
PID 4896 wrote to memory of 2904	4896	ZapretTray.exe	91
PID 4896 wrote to memory of 3296	4896	ZapretTray.exe	93
PID 3296 wrote to memory of 5532	3296	cmd.exe	95
PID 3296 wrote to memory of 4716	3296	cmd.exe	171
PID 3296 wrote to memory of 5668	3296	cmd.exe	97
PID 3296 wrote to memory of 2808	3296	cmd.exe	98
PID 3296 wrote to memory of 3384	3296	cmd.exe	99
PID 3296 wrote to memory of 4668	3296	cmd.exe	100
PID 3296 wrote to memory of 916	3296	cmd.exe	101
PID 3296 wrote to memory of 5524	3296	cmd.exe	175
PID 3296 wrote to memory of 4904	3296	cmd.exe	103
PID 3296 wrote to memory of 2136	3296	cmd.exe	261
PID 3296 wrote to memory of 1408	3296	cmd.exe	179
PID 3296 wrote to memory of 1484	3296	cmd.exe	106
PID 4896 wrote to memory of 920	4896	ZapretTray.exe	107
PID 4896 wrote to memory of 5780	4896	ZapretTray.exe	108
PID 4896 wrote to memory of 1120	4896	ZapretTray.exe	238
PID 4896 wrote to memory of 1884	4896	ZapretTray.exe	110
PID 4896 wrote to memory of 1864	4896	ZapretTray.exe	112
PID 4896 wrote to memory of 5500	4896	ZapretTray.exe	113
PID 4896 wrote to memory of 3744	4896	ZapretTray.exe	114
PID 4896 wrote to memory of 708	4896	ZapretTray.exe	313
PID 4896 wrote to memory of 3752	4896	ZapretTray.exe	316
PID 4896 wrote to memory of 4600	4896	ZapretTray.exe	319
PID 4896 wrote to memory of 5380	4896	ZapretTray.exe	129
PID 5380 wrote to memory of 4372	5380	cmd.exe	131
PID 5380 wrote to memory of 3544	5380	cmd.exe	292
PID 5380 wrote to memory of 3548	5380	cmd.exe	370
PID 5380 wrote to memory of 3568	5380	cmd.exe	134
PID 5380 wrote to memory of 5984	5380	cmd.exe	213
PID 5380 wrote to memory of 5148	5380	cmd.exe	288
PID 5380 wrote to memory of 2944	5380	cmd.exe	216
PID 5380 wrote to memory of 4772	5380	cmd.exe	217
PID 5380 wrote to memory of 1668	5380	cmd.exe	139
PID 5380 wrote to memory of 3260	5380	cmd.exe	140
PID 5380 wrote to memory of 5932	5380	cmd.exe	141
PID 4896 wrote to memory of 2120	4896	ZapretTray.exe	312
PID 4896 wrote to memory of 5700	4896	ZapretTray.exe	311
PID 4896 wrote to memory of 5192	4896	ZapretTray.exe	314
PID 4896 wrote to memory of 1360	4896	ZapretTray.exe	145
PID 4896 wrote to memory of 6064	4896	ZapretTray.exe	239
PID 4896 wrote to memory of 5564	4896	ZapretTray.exe	147
PID 4896 wrote to memory of 3420	4896	ZapretTray.exe	240
PID 4896 wrote to memory of 1836	4896	ZapretTray.exe	320
PID 4896 wrote to memory of 3428	4896	ZapretTray.exe	150
PID 4896 wrote to memory of 3768	4896	ZapretTray.exe	236
PID 4896 wrote to memory of 5788	4896	ZapretTray.exe	162
PID 5788 wrote to memory of 4468	5788	cmd.exe	164
PID 5788 wrote to memory of 4336	5788	cmd.exe	310
PID 5788 wrote to memory of 4848	5788	cmd.exe	166
PID 5788 wrote to memory of 1304	5788	cmd.exe	244
PID 5788 wrote to memory of 5408	5788	cmd.exe	245
PID 5788 wrote to memory of 3024	5788	cmd.exe	247
PID 5788 wrote to memory of 4132	5788	cmd.exe	331
PID 5788 wrote to memory of 4716	5788	cmd.exe	251
PID 5788 wrote to memory of 3740	5788	cmd.exe	253
PID 5788 wrote to memory of 3444	5788	cmd.exe	256
PID 5788 wrote to memory of 4376	5788	cmd.exe	396
PID 4896 wrote to memory of 5524	4896	ZapretTray.exe	175
PID 4896 wrote to memory of 2448	4896	ZapretTray.exe	176
PID 4896 wrote to memory of 2972	4896	ZapretTray.exe	177
PID 4896 wrote to memory of 4640	4896	ZapretTray.exe	306
PID 4896 wrote to memory of 1408	4896	ZapretTray.exe	304

cURL User-Agent 36 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	12	curl/8.8.0
HTTP User-Agent header	16	curl/8.8.0
HTTP User-Agent header	68	curl/8.8.0
HTTP User-Agent header	179	curl/8.8.0
HTTP User-Agent header	182	curl/8.8.0
HTTP User-Agent header	250	curl/8.8.0
HTTP User-Agent header	57	curl/8.8.0
HTTP User-Agent header	93	curl/8.8.0
HTTP User-Agent header	110	curl/8.8.0
HTTP User-Agent header	56	curl/8.8.0
HTTP User-Agent header	168	curl/8.8.0
HTTP User-Agent header	86	curl/8.8.0
HTTP User-Agent header	124	curl/8.8.0
HTTP User-Agent header	173	curl/8.8.0
HTTP User-Agent header	46	curl/8.8.0
HTTP User-Agent header	73	curl/8.8.0
HTTP User-Agent header	150	curl/8.8.0
HTTP User-Agent header	47	curl/8.8.0
HTTP User-Agent header	84	curl/8.8.0
HTTP User-Agent header	99	curl/8.8.0
HTTP User-Agent header	113	curl/8.8.0
HTTP User-Agent header	231	curl/8.8.0
HTTP User-Agent header	234	curl/8.8.0
HTTP User-Agent header	69	curl/8.8.0
HTTP User-Agent header	77	curl/8.8.0
HTTP User-Agent header	129	curl/8.8.0
HTTP User-Agent header	146	curl/8.8.0
HTTP User-Agent header	169	curl/8.8.0
HTTP User-Agent header	217	curl/8.8.0
HTTP User-Agent header	228	curl/8.8.0
HTTP User-Agent header	251	curl/8.8.0
HTTP User-Agent header	198	curl/8.8.0
HTTP User-Agent header	214	curl/8.8.0
HTTP User-Agent header	226	curl/8.8.0
HTTP User-Agent header	184	curl/8.8.0
HTTP User-Agent header	206	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe
"C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "zapret"
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "zapret"
  2⤵
  - Launches sc.exe
  PID:2904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5532
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4716
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5668
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2808
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3384
- - C:\Windows\system32\netsh.exe
    netsh interface tcp set global timestamps=enabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:4668
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5524
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:2136
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:920
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:5780
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:1120
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:1884
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1864
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:5500
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:3744
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:708
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:3752
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4372
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3544
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3548
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:3568
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5984
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:2944
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:1668
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:2120
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:5700
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:5192
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:1360
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:6064
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:5564
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:3420
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:1836
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:3428
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  - Badlisted process makes network request
  PID:3768
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT3).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4468
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4336
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4848
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:1304
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5408
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4132
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3740
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:5524
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:2448
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:2972
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:4640
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  - Badlisted process makes network request
  PID:1408
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:3592
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:3396
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  - Badlisted process makes network request
  PID:4148
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:4072
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:5520
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT4).bat""
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2816
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2848
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2424
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:600
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4412
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3728
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:3772
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  - Badlisted process makes network request
  PID:4788
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:4284
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:2544
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:3548
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:5984
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:1352
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:2944
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:4772
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  - Badlisted process makes network request
  PID:5760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT5).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2564
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1156
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1080
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5800
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2876
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:1780
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3768
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:1120
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-l3=ipv4 --filter-tcp=80,443,2053,2083,2087,2096,8443 --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=14 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:4540
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:2572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4716
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:6068
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:1304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3740
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:5408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3444
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:4100
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:3024
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:5532
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:744
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:2904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT6).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2136
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3416
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3216
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2912
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:6024
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2200
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4496
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3176
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:3760
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:2204
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:3040
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:5100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3544
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5148
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:2408
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:3224
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:1176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:2620
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT7).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1896
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2304
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2364
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5560
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4908
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:8
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5300
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:1408
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:2876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:708
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:1780
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5700
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:5416
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1836
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:4336
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:2120
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4600
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:5192
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:1120
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:3752
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:2768
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT8).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1484
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1692
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1160
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4132
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2696
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2648
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:1316
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:2912
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:6024
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:5068
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:3252
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:5900
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:2424
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1056
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:524
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:4676
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:4412
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:1832
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT9).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2432
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:208
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3116
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4680
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2444
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5628
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4148
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5924
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts,md5sig --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT10).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5760
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5624
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2460
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1184
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4160
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5668
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:952
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:1092
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=none --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:3032
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:3888
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:3980
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:1648
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:6004
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:3764
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:4248
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:4648
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:4376
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:1788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT11).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2200
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4684
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2004
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3908
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2336
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4076
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4552
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3848
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT12).bat""
  2⤵
  - Executes a command shell one-liner
  PID:600
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6140
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5008
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5644
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5580
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5388
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:6056
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5468
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=3 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:4852
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:5024
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  - Badlisted process makes network request
  PID:5976
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:3132
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2364
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:2560
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:5708
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:5656
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:6128
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:2464
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT13).bat""
  2⤵
  - Executes a command shell one-liner
  PID:4368
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1548
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4116
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5276
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4824
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:776
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:708
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:2652
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=5 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=7 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=mail.ru,altorder=1 --dpi-desync-repeats=5 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=mail.ru,altorder=1 --dpi-desync-repeats=5 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=mail.ru,altorder=1 --dpi-desync-repeats=5 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:4712
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:3228
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:2648
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:4464
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:3216
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:5620
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  - Badlisted process makes network request
  PID:4452
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:2000
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:1116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4540
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:2620
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (EXP).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4552
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3888
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6004
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6012
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:3332
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2612
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4264
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3804
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-l7=quic --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun,unknown --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=4 --dpi-desync-cutoff=n4 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=480 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=4 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --hostlist-exclude-domains=fonts.googleapis.com --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=480 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=4 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=5 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_4pda_to.bin" --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:5644
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:5528
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:5280
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:4176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1776
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:3512
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:6056
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:3712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:208
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:5744
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:6008
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5676
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5628
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1380
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3028
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5984
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3772
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4788
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5276
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:2672
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:3788
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:1188
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:3248
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:5176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2904
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4336
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:2764
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1120
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:4812
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:3752
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:3040
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  PID:4372
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3888
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6004
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5272
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:1768
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:6024
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4264
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5820
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:4356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3228
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:4252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5620
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:5600
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4712
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  - Badlisted process makes network request
  PID:5976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4464
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1116
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:3216
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:2464
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:2560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4640
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:2620
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:3672
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT3).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1604
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4680
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6000
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5592
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:3972
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5628
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4832
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4748
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5268
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:5664
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:3116
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:5920
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:1844
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:4492
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:4148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4260
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:4332
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:3740
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2696
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:5688
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:4884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2336
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1884
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3864
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1876
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1668
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:6072
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3552
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5612
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:6140
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown=0x00000000 --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:1068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4648
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:3940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4852
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:2436
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:3980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4284
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:3416
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:4420
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:4936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6048
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:3100
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:796
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5068
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:5024
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1832
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (SIMPLE FAKE ALT).bat""
  2⤵
  - Executes a command shell one-liner
  PID:4452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6064
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4680
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6000
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1380
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4892
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3192
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5600
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5976
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:5464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1112
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:5984
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:4832
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:3028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3420
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1916
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:2140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2304
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:2536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1280
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:4212
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:1852
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:5500
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (SIMPLE FAKE ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1680
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2836
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2644
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3164
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4960
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5408
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:3276
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:2612
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n5 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:6024
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1160
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:1552
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:4992
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:3896
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:1860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3252
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:3176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:3476
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:5008
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:3804
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:1452
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (SIMPLE FAKE).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5672
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2500
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4916
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1256
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:6104
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5940
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5628
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5592
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    PID:3192
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:5600
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2384
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4160
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:2672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:3712
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:4812
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3040
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:1184
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4076
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:1712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:2560
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:6064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:776
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general.bat""
  2⤵
  - Executes a command shell one-liner
  PID:5468
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5192
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4148
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:5280
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5500
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3116
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:2036
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5852
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:1876
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://discord.com"
  2⤵
  PID:4960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6004
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://gateway.discord.gg"
  2⤵
  PID:4952
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://cdn.discordapp.com"
  2⤵
  PID:3332
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://updates.discord.com"
  2⤵
  PID:1368
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.youtube.com"
  2⤵
  PID:4868
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5272
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://i.ytimg.com"
  2⤵
  PID:1668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1768
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://redirector.googlevideo.com"
  2⤵
  PID:2612
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://www.google.com"
  2⤵
  PID:4496
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://arcraiders.com"
  2⤵
  PID:4436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2204
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect}" "https://id.embark.games"
  2⤵
  PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT).bat""
  2⤵
  - Executes a command shell one-liner
  PID:4924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4376
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1052
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:964
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1008
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:124
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:6052
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:4656
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo( ="
    3⤵
    PID:5808
- - C:\Windows\system32\findstr.exe
    findstr /r /x /c:"[1-9][0-9]*" /c:"[1-9][0-9]*-[1-9][0-9]*"
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp=443,19294-19344,50000-50100,1024-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=1024-65535 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:2664
- C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\Setup.exe" /update "C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  PID:5024
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /run /tn "ZapretTray"
    3⤵
    PID:5228
- - C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe
    "C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe"
    3⤵
    PID:3164
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" query "zapret"
      4⤵
      Launches sc.exe
      PID:5864
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" query "zapret"
      4⤵
      Launches sc.exe
      PID:5624
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT).bat""
      4⤵
      Executes a command shell one-liner
      PID:5272
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2456
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:1840
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:4484
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:4772
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:3396
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
        5⤵
        
        PID:2940
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:5620
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:124
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:4916
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:5520
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:5940
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:1500
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:4376
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:1720
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:3504
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:4548
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT).bat""
      4⤵
      Executes a command shell one-liner
      PID:4080
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4500
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:2796
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:2356
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:6020
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:5548
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
        5⤵
        
        PID:3076
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT2).bat""
      4⤵
      Executes a command shell one-liner
      PID:968
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5508
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:1804
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:4704
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:2876
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:2620
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
        5⤵
        
        PID:696
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:1880
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:3908
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:3788
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:5704
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:1480
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:3260
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:5372
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:4716
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:4100
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:5664
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT3).bat""
      4⤵
      Executes a command shell one-liner
      PID:5876
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1860
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:4140
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:1712
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:2560
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:6064
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
        5⤵
        
        PID:2000
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:4520
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:5948
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:6028
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:1184
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3848
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:4136
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:4460
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:2456
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:5032
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:5196
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:4300
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT4).bat""
      4⤵
      Executes a command shell one-liner
      PID:1900
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:6052
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:4256
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:424
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:2096
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:3356
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
        5⤵
        
        PID:4180
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:3524
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:3000
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:4172
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:3128
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:4500
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:2796
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:5736
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:3288
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:4892
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:3192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT5).bat""
      4⤵
      Executes a command shell one-liner
      PID:4756
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3744
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:2688
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:2696
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:1988
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:2436
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-l3=ipv4 --filter-tcp=80,443,2053,2083,2087,2096,8443 --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=14 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
        5⤵
        
        PID:3332
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:2612
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:4496
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:1924
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:5744
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:3416
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:5984
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:1920
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:4332
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:4952
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:4488
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1452
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT6).bat""
      4⤵
      Executes a command shell one-liner
      PID:5264
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4072
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:6072
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:1768
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:2644
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:2664
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
        5⤵
        
        PID:5808
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:4344
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:1940
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:1052
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:3024
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:5376
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:2680
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:2940
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:5512
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:4568
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:2112
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT7).bat""
      4⤵
      Executes a command shell one-liner
      PID:4116
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3320
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:5956
    - - C:\Windows\system32\netsh.exe
        
        netsh interface tcp show global
        5⤵
        
        PID:1128
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "timestamps"
        5⤵
        
        PID:5012
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "enabled"
        5⤵
        
        PID:5088
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:124
    - - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
        5⤵
        
        PID:6104
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
      4⤵
      PID:252
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
      4⤵
      PID:2364
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
      4⤵
      PID:5104
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
      4⤵
      PID:5100
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
      4⤵
      PID:2356
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
      4⤵
      PID:876
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
      4⤵
      PID:4856
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
      4⤵
      PID:3404
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
      4⤵
      PID:2876
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
      4⤵
      PID:2840

C:\Users\Admin\AppData\Local\Temp\files\core\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\files\core\bin\WinDivert64.sys
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\Setup.exe
Size 80KB
SHA256 3a3e6f62d7e18f9787a8b6ccd7d90ace8314c8369f44a35e4da3eb65f1c913a1
MD5 98b5ebb198c6a68865a4137ffb69a1f6
SHA1 734bd9072ef6ce9246f5e0881b3f14d95059b175
SHA512 534137febc3789647e40d4439fb609caf13e2ef26d16cf4d63575c5cdfd29f698175d61e9cc637466f205bf6c555dbbabbe5b9e37ec62c38a8c46fbeba6c369a
SSDEEP 1536:I3kXkcM3WZ1Qs/1vF5IHBNKmw1YYA0Rx78:v31QUnAsmw1YYA0z
TLSH
T140834B02F7F9C614E3FE4F38A4B605904A35FA43EA53DB5C1C8718BC05267E58926BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZapretTray.exe

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\ZapretTray.exe
Size 256KB
SHA256 e6a0bb5215a99371f48ed8d84444e58decd7e40508b560682cb1345bf3d98d0f
MD5 c9681bd2f2e9e53e9ba5f21ee0f606ac
SHA1 0ea94561752efd87b69d57841814e13095f87761
SHA512 256a21846eaa815950b42cc533682dfd21b14bdadb5cc4bbd8337f29688ddb68c84c3709557279aa3eda349816df1a3d1d6d5c28174f01d9a5b8a99f87a69ea2
SSDEEP 3072:kVCAM6db859QgGSB6x2h2SgZw0feM//zNJEY4rTAky9KHgv5tZSU1YYZBlrdq:Eh1qQgGUM2h2S7mDDNJQy9KH80grZBv
TLSH
T1BC445B1F77BC4E60EABE8778847505828635F603E78FEB4C8D8B68FC0869771A511693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\cygwin1.dll
Size 2.8MB
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quic_initial_4pda_to.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_4pda_to.bin
Size 1KB
SHA256 e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
MD5 6422bac6b3e976bab5d21451b834221f
SHA1 5c3cbd90820054aec414e1c6e89f0ed03eb1f1d1
SHA512 0c2b212260fe6a4ef7af91f2e5cb1d9ba117c0654a80b4153301c23f08e63c8921835ae5e66f287b60722e1aee5b122fd18ce856f1aaba52604c0f51d9859205
TLSH
T1F721EA9951EF257024F6430A18E9A4B6594366C74AF68BF351D90CA06CE974B8F09863
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_5ka_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_5ka_ru.bin
Size 1KB
SHA256 247dcd97f53bfae5482e4b2b66acdb01e48ee6c29c5ca526c9b241fa38c233b5
MD5 a2ab0c128e6834d716823c376188edc8
SHA1 68791babdcd1887cf2c393054d465888e126ed4a
SHA512 48cb53de5bfeb687c1df038d99ee3abdf7ccc45eb33654212bd4d1dedd6e4a4ca36ec19fd95cdb344f61e1bf701bd34541353931801ba56f88f2255479f8a758
TLSH
T1E321C5AA790192DC2666C1D238886A85E9C4DEF2BBDCBC42D31934F16E1F409D098E47
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_lemana_pro.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_lemana_pro.bin
Size 1KB
SHA256 c2ff932a40d69a61321c1fa091a6182e16a2fb85f36881b6864f864f07508848
MD5 563619ff38a65d63cd01b11fa2b2e099
SHA1 5474f02b594000bb8cf447c132b191d58ff29fda
SHA512 4c02f7034f6bf7d97ab0f3229d6f794c22b538a7b3d4a403a94befc76e2b121e1f3297b6d0bff918d47f50438068a57ed05901ce26c3d85c976cfb9637d82d43
TLSH
T10621F1AD2412CE8FDD502433A71140052A3552E2565F145762049C9A4762C2DA42B779
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_rutube_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_rutube_ru.bin
Size 1KB
SHA256 74b1dfbdec125263c9407436658b0a848b8f0a934b8063d11571a6a2146a4a7b
MD5 fc935731a55d3e715d5e216c50d937e7
SHA1 90d3e8ab70e62556bdba81869bb2127fe39f254f
SHA512 a43d195c1bb8d06e1a670760ef1aa308e1820488d88b64acf848a81004eca058e64bed60f069eb2e94fcba32610d346da1c2eaaf7d6f3b3a7efb5af0432c865d
TLSH
T12621418325867A72CA8A807A9C354C38833C0F5AB18E741162CCEB6B30CA626E30385D
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_steam_chat_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_steam_chat_com.bin
Size 1KB
SHA256 1da1407166f5d2ade80f1d3c86d828178e13f08050c40fda2b0a4d276318642a
MD5 f299ae597213e82160dff35f90c6c365
SHA1 ff9145f04a472f2cf2955d4fcf1cf01e990207fe
SHA512 8dbe05156a8e198f9d3acdd5c29a7662683f03c2fab5079782cbabb0b3d949605b137612f7ed0cfbb39ae441e11004241ade134dad37c606868348cbf82bb77e
TLSH
T12B21C04D3A113576C29649350695B36892C0A2010AB850337AA309EB14F2BE04FB2436
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_steamcommunity_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_steamcommunity_com.bin
Size 1KB
SHA256 2fe18b3bd20807d36704d0b072092ee49ae84edca907a4420ab9a0f0f28fddcf
MD5 7429222625dfb23a41af04a4aa704acb
SHA1 5e17589b3ab3d86dd269e6382dfdd15931f386e8
SHA512 28563bd1fa798dcd3d95f13421c3b5041363cf0943baa3479138375f6daabbbfcaa6e2658b8e8e126850a40bdd658ce9a9e43abf5a5a073e6377a28211eb5243
TLSH
T1DD210DEF44273587CE95476523AC42FCA7C3956FC648047A6FF372051C7C14EE591415
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_steamstatic_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_steamstatic_com.bin
Size 1KB
SHA256 4f1468adcc30ac7ffd9e04627c7289968f8c4ae476626d05f282da8064fe64b4
MD5 6db6220f66db20028022466cb1376e29
SHA1 487e676a5392f6b31e5c5dfb6c5ceb25044fe906
SHA512 1a22e2ff17eb7601c707ec69f14c896eb7402496e24b0de0567a9351815c26d33ae9f7ba23a33b5a8c8f5fba106ebb95a01cecfe000cdd5bdbca8dde6635c40f
TLSH
T150216A2085173F5CCA50F479C8B0BCC05310C933654F30540784070760C38D3C1EC087
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_tencent_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_tencent_com.bin
Size 1KB
SHA256 d250051d6200946a7ba0629c59c5641432957fa3513081a6c3c5aaa91a62ac03
MD5 0b98262b43c075dd041329bab61a68c3
SHA1 87d9162c43854b7084e08c15988661491e149589
SHA512 96899e973a30e850567ac0912ad5cf04c147e26891d8655e838ba756213c728ff85e1c63ad8c6f29fa8cf403dddf9217a0cf658af846e34fa9fdc69a76d5ba44
TLSH
T15921177410ED13603E80128030AA4A2BBA705A58ADD0D90F21A3A0F5DD51832FBFBFE8
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_www_google_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\quic_initial_www_google_com.bin
Size 1KB
SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 312526d39958d89b1f8ab67789ab985f
SHA1 49a06ceebb13807faaf2a935a716127faff9864d
SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
TLSH
T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
MD5 SHA1 SHA512 TLSH

Submit Download

stun.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\stun.bin
Size 100B
SHA256 9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
MD5 0357596c0e38a10a4b99dca2032419cc
SHA1 05fb322426bd56771a1e1873e88626bc98d34563
SHA512 319880f7624ff32720d11b79e5cdc24e24ee482a92cd2224e2175936b54a32916d059f431bf2f0e8ff74cf1be41395a462665e75fd1cf17a2c126d01cc2ee165
TLSH
T181B01200C24B4DA4C014103CC4436A9F84A415D58F00DFC389091E9050CA05E6CC1ACD
MD5 SHA1 SHA512 TLSH

Submit Download

stun2.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\stun2.bin
Size 120B
SHA256 b7c2497496039c541f7337ac8536813f0a1cf52363ab2faa5213b7816d458813
MD5 f01f84f99471de0c7c580da6a14fcdc6
SHA1 4ba9e863501403b8bda56a1c482a5f351880a3d8
SHA512 70a0a416d2b2ab8875b9e68690a4d10f735a9b2173aa3c4dd9d6fb1fe0ad228d8d767deea97f5eece1380f5ed2ef0266fa4d26ec18e3aa0763c14ae5cb3da3ff
TLSH
T1E1B02B0080B000900499853B41050B585B020AE4A373C9110A0B58D612C60308C08224
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_4pda_to.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_4pda_to.bin
Size 284B
SHA256 eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
MD5 e6d649de132c3c10cb62531ef74f5b73
SHA1 689c7e8d021a99d0a64fee9099fa9012a3528265
SHA512 f7be809482e3098a5a8f79a759d1f8bcdc2e5201ac35f06eb8662afbb8194f2dfacc2c3e64114557de78e935086cad43880be83b0af1611a1aa0bced0facffba
TLSH
T14ED02B87C982745FDF090B7AA5D5C9B9DED3F1EA03CB8F4768058344FAD85B1422208D
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_5ka_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_5ka_ru.bin
Size 654B
SHA256 1e8871e272591c5a277d38a6166af597c1fecb1cf58e85162e8f1968ec08d018
MD5 710437a88c95578373f1fd2cf971100a
SHA1 14f0032c13f75bbc4d06d8a177e92499a57dfd95
SHA512 ef0229f348d359e30364d837ef180d2e57c365dcfb0f7f34011d6fe3e100ee953b26e5a6e9d8d3813d699c6f32cedba3b2040999ac809235271717f184a4a83e
TLSH
T118F023A7255B1C13F95712213CD5C14947526D247B033A576245FF30C8DDBC24BD070A
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_awswaf_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_awswaf_com.bin
Size 1KB
SHA256 6405e264eff9f33632e727f6d696ff39503d3652f0f0be00921f06f97720a5b0
MD5 7b6d8d620bfc15319eb179592cab473c
SHA1 7e6341f395d25b5b4619280765b37a392aaccd9a
SHA512 f907efa92ee7da74b25a6dbbb979e1cd8ac00d5dfbc869e459172770b9a501a135d1015b0fe8a67cdd9ef2f9556b87c02371aa46d333ba8d5a862a68dc9ca87f
TLSH
T19B1144A3135259CAD2414E340D8F54EAC206A104C7A35BCFFAA2DA50CDBBD86441219D
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_max_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_max_ru.bin
Size 664B
SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 b2b3e684ce449b60f0bc5a9028221a08
SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
TLSH
T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_sochi_park.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_sochi_park.bin
Size 244B
SHA256 ad552922acfe029521da884ea29f4bb28bb6bdcee9b1a70b46adbfd266c11d4d
MD5 cae56426ee185c46b19cd4f7dc8a6222
SHA1 13fc2ceef9f883203f0cceef5978c3bb3b7f8972
SHA512 68a928058cda86b67d0e30014d135eae1fc632e3daf4b504f618fa6809878c937000737ae5fbc8acd6eaa1ab6223138ea0006a54abf32f341cc8073fda966fa0
TLSH
T199D097C39901BC3E70204720AA2E86AEA1A370139B03670E30F6F0201AE8C643F33E81
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_steam_chat_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_steam_chat_com.bin
Size 1KB
SHA256 388e9a09bb2758ebbce34a0e27d8efa41bbd59954c9c32d8fb74b4bce2d99c67
MD5 eae090dc82216136fd881102c217e35b
SHA1 0b0bf6ce3e40b35eb75f3b3334912ac56c149165
SHA512 15223df4fb15ddf25ea0500bdb863698f540c076d0cc0f2b049934411e7fe7fced9b876def0371f6484d6ce7308e2260005dbacda14d529ce2f18043cef6a1b9
TLSH
T1281183B2184A8882EB014276084E581253C1F08132E3CFFAB5AEC7984ACB8D348B9318
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_steamstatic_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_steamstatic_com.bin
Size 1KB
SHA256 3f8ba0b0de17a3feda593ef2cd82a1b44ca566f96acaa42f6fccd69f2484ecea
MD5 2f24d2ddfb3fa5e796fe16cae9898c30
SHA1 0e6b5e2d9436493d3203364a1c45a287df72910b
SHA512 3118123a1ac1505b7a1d790c17d59e9e9b8506b15177f6c453aef7293099aaa43f13ae910e3257a20d3d12e273d65975ccfe31e48f5337ed21d2e031703f343d
TLSH
T1131144192111D687DC1D453608DF409A93E7D80263930FEB32DEBA66CFC01C78986255
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_teamspeak_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_teamspeak_com.bin
Size 1KB
SHA256 1336b7529c050a9c5a4728368430686311c448d4b3ba61bfc8d1e10a15de438a
MD5 a0fb7b30a27e79d42006e85df6dfd2a7
SHA1 49069c889e7802f8a8d38053e60cded1f3bdd78c
SHA512 1e822eb8fdb1023e41a6b6e2c1074a5d1291b4f508c061c42e841a4ceb6716e10c895571e31040e8e5889ff82ef8c1f1d4bb4944a307d9b6b4c16e7a75b950fd
TLSH
T1AD1183921240E65FC16A263209C9CCF5DF85D0140AE253C71DC7DE008A9219699631AB
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_www_google_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_www_google_com.bin
Size 681B
SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 41e47557f16690df1781f67c8712714e
SHA1 2f3ca8e75528e0e7797e8f5edfdc582535531913
SHA512 e8b644d7996168e51d8b991b1d263b9d98f7178bdd9a060078cf4f5ef368fa6e864492b3365227aa68d4d079d734f17d8a5755bbab7424f1bb66e82c0b72f1dc
TLSH
T1D601F4AB1D42D11AD9020E1629D7854A51CADA0561138F772705AF11E8C3D97CD10BC9
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_www_sferum_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\tls_clienthello_www_sferum_ru.bin
Size 661B
SHA256 e6dd8d724eecc6a7340bf64e2ebec81c60bc4e078c6f702b4b6ba9bf184180ad
MD5 2e7d5581af22c22b0828e1048acb6dd4
SHA1 49179dc0c4e65937af15de143b3baf7e8802bf2a
SHA512 35cea376e854b246f80b9348cc93c525641ae203cc4cf73911d92e31e9617a922051551bfffca1d5f057bd54afc4037357a471a81969a48e1c6f04643ebab7a2
TLSH
T1780123860047745BD9875F2B0CD5D5844689F04AB6078327B0E3F5A8EF51AD55990B2E
MD5 SHA1 SHA512 TLSH

Submit Download

winws.exe

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\bin\winws.exe
Size 199KB
SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 d498e19bc7a79dd1efcb6b928cbe9909
SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
TLSH
T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (ALT).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT).bat
Size 3KB
SHA256 03daa1e91c59264139110c4fd0216ac57e7387efa1c7abdb0f9c3e65492b5edb
MD5 5a8b4cd8849bd1c9b22a9182dfaa629f
SHA1 d54226dc27e92e2116884f9114d4bbee796fa788
SHA512 09fca6e42dcfde29f53540b8d3c5f9e07ac3198f00d6d4befdf6e77035f999f5370f54316e28670b7cfb60ebe20abb782150af4552450e2b29a276ec7de11d26
TLSH
T1E4816BA7E00CDE47F5CD653EF89BA5A420279C8329D6D452839B89F8CC0EDBD684E480
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT10).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT10).bat
Size 3KB
SHA256 00a37955e2a8e2c2df1859c7e542c24a26f613373a0930e68b20bdeed08d4863
MD5 91e4da2117ed62a323d8ccaf4a0e9693
SHA1 271b25f95c008fb79752f3086c538f3ecb94ea2e
SHA512 3b7583db9256bd8582afa2860ed4a79b724c174405a8c4fd73a4ab4bda375b3dfbfc9686bbcc066c462e3cc2e74b3b92208f41b36ebbf4f5d74a79dd2240a56b
TLSH
T142713CA7E00CDE47F58C697DF89EA5B42127DCC328D6D456439B85E8CC0ECBE584E484
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT11).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT11).bat
Size 4KB
SHA256 f11cf901444b7b1de316dae78852449f8d390e2ccd9d5eeb7a03ef732cbd1bae
MD5 38664ef4dc5812b7e11210f2d565efdd
SHA1 92fa06a726cf6829dc405224a6b1849c9c462f59
SHA512 a12c3dbc81e8a9f35f65308aa587044f58ed5e980d6c9bdf77be9beb8fd2062c78395564ab7e2575bcf2a6c70f40e66690954b8bd8e58ba1e87e90313f9912fe
SSDEEP 96:nL674QGB/GRRQ1zbIKdUGB/GRAVv/GRRQuv/GRA5P+R0ri5+RRLx/:A4QGB/GRRGEVGB/GRkv/GRRDv/GRUP+6
TLSH
T16F9137A3E00CEE4AF68E747EF49EA6A5211788C328D6D452439B45E8CD0EDB9194E485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (ALT12).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT12).bat
Size 4KB
SHA256 9b21fa52d50668b162e5e1caf39b56478184a22565588ec4dce92f4a25fb2dd1
MD5 93d8406c772c53dbf7d93d684d712524
SHA1 d58db5e1917e0c1708afcc9b605b4641f99792b4
SHA512 5e567d89bcca3a83e4b689821262f31b76f407590e2e3b2a2f58877e2e3646c91f1d9be2f0a8b84ee3e79dfea9830214c4fcef95f1fd950fd2d1497bc96f900e
SSDEEP 96:nL674QGB/GRRQ1zoLIiUGB/GRKVv/GRRQuv/GRK5P+REji5+RRLx/:A4QGB/GRRGl1GB/GRav/GRRDv/GReP+g
TLSH
T1109149A3E00CEE4AF68D747EF89EE6A4301788C328D6D453439B85E8CC0EDBD594E485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (ALT13).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT13).bat
Size 3KB
SHA256 8eadbd0eac63aa87adaaf07359b815c316614c27cf6b478e4ef9b35c2fd8e7b7
MD5 82a31bff3556ba00d49834b278e0c642
SHA1 a3995ec5fd3f91f4186af30218a6596c5a1fc61b
SHA512 8686b8190250b90de8a5e4abcff08d3320b48f380cecf5f1c66232b03d3ab147992754e5ba6ab3e3882e102a399a92112964ff857a239dc43ff1234a2cf489d6
TLSH
T1FE818E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT2).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT2).bat
Size 3KB
SHA256 c9a43d689bae4303b061294aa8ce8dcd5c5a38f19c962391cafeef82bf7b5023
MD5 f7466f42744a09aed245dc31e05d4620
SHA1 f008f4c982f90c56d503cb8919547a1cc6e5933a
SHA512 e4a53daddb8308c1d6025226428c471ebb8a0e209e308453e1da39ea6ef23009524113987b4fec3801d5605698644efd11644f84c6003a93f96c38e4aea34192
TLSH
T166610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452529789E8C84EDFA494E485
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT3).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT3).bat
Size 3KB
SHA256 eff9c48a0b379cd1c8f770bd7e64c52dad99e1f7ae082de5bc2fb8a88d9ee43c
MD5 53bc1c1c7f49ef19f8bc1a336b19c166
SHA1 6d81e9989c80002378088009f097e60085db70be
SHA512 6782502ee1e2ed97e06f5215d3775c162e8f4d35a401697a80b9d7a0734572242092a3b4320c1054383c3e4724e6006de7bfe1f779586ed20503f0cac2ed8454
TLSH
T129715B93E00CDE46F5CD687EF88EA5B56427888728D6C85152DA49E8CC4EDFA6C4F085
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT4).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT4).bat
Size 3KB
SHA256 1565de56c2782c79ce20277081ea39643957d74db2b0df17e4ec493aad43afaf
MD5 ba4e3711e01e80e8d70eec4c44098d61
SHA1 13571571e0d6d295172961a5c9021128e726746a
SHA512 c9c0be5d7dc6f77278da65e4b2d6c83c4d166838400c40b4736155fdeab2a850031ecfc4f8c4813db78a38e909c0c65d9c21a1c7344284878beae8c955543029
TLSH
T18E813993E00CDE46F6CDA53EF8ABA6A421179CC318D6D452439B89F8CC0EDBD584E594
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT5).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT5).bat
Size 2KB
SHA256 e745729c4785de344b36105407b5b6bdbda17d655be7c314b3aa73826db79272
MD5 1f035e25fe65433fa229f90f18468ef6
SHA1 0f4b03120ed08ea11b291940726d119a77d872c3
SHA512 e6e33b1e907c554cd683ad10c9cd02472516de6b9738bb4ed16bd41dacbc1873bf421cd92a9992cafc084e758753e7b8e386d2da266bac994f4572b202c34f9e
TLSH
T13341F397E00DDE46B48DA83EFC5AA5F5601B98C32CE5D466539788E8C84EDAE8C4E484
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT6).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT6).bat
Size 3KB
SHA256 c32d3a253a3dcd827b5a6d3a1d903beaeda0e5ee65c1d2d1b0abbfc1f04f3005
MD5 37ec25f0901fbea19ac76881e634402e
SHA1 04bf0761db34aae33c00e5e3b00f48ca2a72ce2c
SHA512 e2052e74adc43a8f5721ec4228b51efdf24054c05e5381b85353ec3a32a0e6b051248d60774ad171cfe5cc65e5aa9da6cd6ce35708a11e3bd796b90f63362428
TLSH
T15B611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452529B89E8C84FDBA494E485
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT7).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT7).bat
Size 3KB
SHA256 147911332e2734a3a7ff760fbabb1bd44d29e75ed0be12bced734270ec592ac9
MD5 7f98211bb42a98978221987bc39c6c3e
SHA1 a2c0c10c2074f090f819d7817bb38b7c6ccaa950
SHA512 dffd8afa407318abc55777e0b95b398a1298fb3ab6deaf57909e9cf737e6d8f3c17b4e76da5597a09d77e49a6fd51fe97a1e07d7f31a335aef691d2e3944beb5
TLSH
T19251F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT8).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT8).bat
Size 3KB
SHA256 bad7e2fac768330ad003b91d09a66035b43511155bd54682ba4833d3af0b1506
MD5 b550281136fb54ab10fc573dc48f2c10
SHA1 16e90df716e43e647a1ce92b8be05830c5ca2e60
SHA512 453a9197c3605305579f5ac30ca98c35c18f445da081c1818bbbfeb8d5ee1daae9c2d152a4827f28686f590f19dc56427a6fe0fef6988ae9c5e5b04538aa7bf1
TLSH
T154713A93E00CDE46F58C683EF89BA5B42127DC8728D5D452539B88F8D84EDBE584E584
MD5 SHA1 SHA512 TLSH

Submit Download

general (ALT9).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (ALT9).bat
Size 3KB
SHA256 10381483a04b690545a052f64a1c84df6857a74ac43a7985c88e2891e443f399
MD5 8789c3e38c7e74560ed25eb88d94316b
SHA1 2deebe6ec3d663cac7a22ce4caa0cd5625273ed7
SHA512 3f6bd5a602b9d933bf51704d743402a00d31ee350be9575b54bf2218dd78aa49f7093eaebecd04df8993e4c8fe89b28e2302327d69a2c1ea527ff4e82b04db82
TLSH
T109616993E00CDF4AB58D6C3EF89BA5B52417C8872CE6C851638689F8C84EDAE5C4F485
MD5 SHA1 SHA512 TLSH

Submit Download

general (EXP).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (EXP).bat
Size 4KB
SHA256 3c83544634f4ab41dab0ff206158d024e4500a549a7d41f8a12810b5b09ef6df
MD5 fcbdad5f4f904ca166f6eacab727ac1a
SHA1 005e3053e72db6cc17b7e01986d60d459e0ecca3
SHA512 3af1e97bd2b5aadcf55be2e1046c96aed9c9efd785a8c8ee92a02d99d2edb092f24464c29b1938943a33fc04b74b0d207dfd0c4047060b5957e77d921d952945
SSDEEP 96:nL6743GB/GRRQ1pT/8EIiUGB/GRrVv/GRRQuv/tRr5P+R75+RR17i/:A43GB/GRRIa1GB/GRRv/GRRDv/tRlP+X
TLSH
T135914CA3E00CDE4AF6CE747EF49EB6A57017C8C328D6D453429B45E8CC4EDB9584E485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (FAKE TLS AUTO ALT).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (FAKE TLS AUTO ALT).bat
Size 3KB
SHA256 2d2311f6d05ba2dbb84840eedc5caf5da84d9bd40c95d83580c82009575e9478
MD5 3ab56032ca476282715f04b1e6ef8de3
SHA1 17f80f91fcadcb623efdc9b0e1cdeaf171313387
SHA512 4909316a1cddc0665d0c3e2d53801cd271ae3043f8405f0d8646e2eb0107cca72777773275a2bc1a21145b96d271857af216689bd9f7f61669ba323da829dac7
TLSH
T191714A97E00DDE47F68D643EF89FA2A46127C88329D6C851829A84F8DC4EDBE5C4E584
MD5 SHA1 SHA512 TLSH

Submit Download

general (FAKE TLS AUTO ALT2).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (FAKE TLS AUTO ALT2).bat
Size 4KB
SHA256 46ab1f463e3a594750e96cbab5e1d8629b5561abe1eb155d24a34f93dcdf4e66
MD5 06c98777352036de3d658a7647a7ddec
SHA1 2fc127e3465ab701eaadfbfc875b09f79f3b9726
SHA512 4f09db603fca28b600bb74f98655eba06cf5090f619679f05c24caf383a0978c12ae10be347d1f77b8ff1088a81315574f083fe15ea8013b015d1666ab373d47
SSDEEP 96:nL674QGB/GRRQ1zxDUGB/GRbVv/GRRQuv/GRb5P+Rii5+RRLx1:A4QGB/GRRGxYGB/GRBv/GRRDv/GR1P+w
TLSH
T143915893E00DDE4BF7CEB43EF89EB2A5211798C328D6D452839A45E8C84EDB9584E590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (FAKE TLS AUTO ALT3).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (FAKE TLS AUTO ALT3).bat
Size 4KB
SHA256 0b701b6df8f0e019a1256d1e86fb4bb073587c6bb2a53dc12f505bdd487074c1
MD5 037619dbf51e60248dca6adc0c2f77eb
SHA1 3103488496373053fbe683f1e08afe6bd897fd80
SHA512 a3b40335c14aae0a29f40fa9c7c2a63fff52f8982d0677bf512df74c7bdbb7ecb19685752dd0b5b56dc20d3e5e34ea7f3606d61f6d70f622b24cea8bca339447
SSDEEP 96:nL674QGB/GRRQ1zd1UGB/GRVVv/GRRQuv/GRV5P+R3i5+RRLxI:A4QGB/GRRGdmGB/GRvv/GRRDv/GRfP++
TLSH
T188815997E00DDE4BB6CE743EF89EB6A5711788C32CD6D452839B85E8CC4EDB95C4A080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (FAKE TLS AUTO).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (FAKE TLS AUTO).bat
Size 3KB
SHA256 88e52040767fcbd4cfe2cc37873158ac890760d3f6e7ff7026c3fb993417e895
MD5 d3cb009397b6266589d1beb74d3be076
SHA1 3d4078e68c2413bc1e61567df3a829838d33130b
SHA512 124e60d8b60d062b0fac162f357a922e4268659347af670ca686f56f033296f905e17b74420d0df4c3d5e5b6b3144bfb91dc59e76eb5324692c22d56a1b3c2e0
TLSH
T197816C83E00DDD47F6CDB43EF89FB6A861279C8328D5C85282DA45E8DC4D9BE584F484
MD5 SHA1 SHA512 TLSH

Submit Download

general (SIMPLE FAKE ALT).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (SIMPLE FAKE ALT).bat
Size 3KB
SHA256 9862af0175a4c3fd3082d3360d5e8bd5820f611dba12b9897628fa1355b9cfb7
MD5 0d6e9c069ee97e73b95b929ecd499c53
SHA1 e3867032d489ce00b4bea2e4c01b54b35ab5be94
SHA512 19e778e23a0c3c16b2f3475b8dd428f49a4d7c36bf20946e857ea38dd7765e08d6fc6c0c81c9ab6a0d5f4b9c3c89a0695b248b862c5d2c440cd43f9c28ef6076
TLSH
T13B812AA3F00CDE46F6CCA87EF89BA6A4212798C319D6D452439B85F8CC0EDBD584E594
MD5 SHA1 SHA512 TLSH

Submit Download

general (SIMPLE FAKE ALT2).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (SIMPLE FAKE ALT2).bat
Size 3KB
SHA256 87dd6441ec797c2cb769fe047846e5869e998ada4fc21f8182597a928cf5e040
MD5 9cddfe2d52dec3f5050a185c0ca8614a
SHA1 f0fea367fbea3e0688cfe6db9fd95d148d7ed55c
SHA512 617660dc85f93bfbb41835209f9cdf540a18e896b1666cb99572ee16f2597729e67dd241f6d460638f0bf2da7bf61597da7358b54e09005edb4b2e7fae384b49
TLSH
T1EE710B63F00CDE46F5CC697EF89AA5B461279CC329D6D452439B89F8CC0EDBE584E484
MD5 SHA1 SHA512 TLSH

Submit Download

general (SIMPLE FAKE).bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general (SIMPLE FAKE).bat
Size 3KB
SHA256 70f248bac2bb442cdd2dfb9215158d091c225003af2a285512dc74eb7ad93f25
MD5 27ae868d1049fa78da2ba1a93bbce507
SHA1 07b58f8cf69e186ce62a749845d291868a0d42c2
SHA512 730bb608ce1c96b4690d469ceb5e95f5c16dfba28fe8fc52289afb89f531fab667690f17a25f84eea8a9492583b257b14a072217233c8cf28682d021aeb1d809
TLSH
T1E6714C93F00CDE46F5CDA87EF89EA5B4212798C328D6D452439B89F8CC0EDBE584E484
MD5 SHA1 SHA512 TLSH

Submit Download

general.bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\general.bat
Size 3KB
SHA256 6ac4a347fa90062b195e4267896eca24da60473965ba5206bf24c7fbb274470b
MD5 6b2d7fea664d9f1667663ba5f033c6f2
SHA1 0c253ff99efaeba4fd61f77efecbe697dc24ebca
SHA512 abdf33f0c1e8999aa9de58e69e929c965a512d5da29289b67a4dae491b481301da34f8062d5523ff446d351f6f4591a447a1cf3ac55c05be0c52e05745d58078
TLSH
T1C96149A7E00DDE4AB68E787FF84EA5F13007C8C31CD6D462529789E8C94EDBA4D4E485
MD5 SHA1 SHA512 TLSH

Submit Download

ipset-all.txt

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\lists\ipset-all.txt
Size 600KB
SHA256 6f9bee038620b527c49fab24b21069de9b2acff1b7693476667c34669204f5b6
MD5 3206bc58ed45d39df984220d638740b6
SHA1 8003eb2a3ff01ac1cfe18f059f0af1590780ad7e
SHA512 21768980d6ac797c9294b2689f277dde48bd011f5b368b206cd06caa9760b9be510e779b37c1a0d94e4c473f603497bec4cc586d14b02b2cbeeb57c4aad0451c
SSDEEP 3072:vdFAYPvI6N2ClwfoPrK1LHYky4deCp6SIcm4BmIKx4w5xteumYEYsppucy7Zn36I:vbYvWLWmreqO3g
TLSH
T160D4593213B41BE78ACEA1EA3323957415D7D68611FAF273CB8F62623D21040F96795E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipset-exclude.txt

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\lists\ipset-exclude.txt
Size 135B
SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 240532f20e114cd6de2906ebc86d683e
SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
TLSH
T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
MD5 SHA1 SHA512 TLSH

Submit Download

list-exclude.txt

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\lists\list-exclude.txt
Size 1KB
SHA256 c9708474e79249845d722b6344370c73b8a4949341f2d8ec6c5b443caf6d44d4
MD5 eb4c6783ee199068c1fdf48a9448fb20
SHA1 2e9ec04614391fe3d723a73e83cde73f51abe125
SHA512 b1cb376508ce8a787aba72e7f52903d88ce60ce1220d63e7f8081544c7c27de53c2db6b3e00f761db3e0866f4cc01c5e3e74e2e3adaf57a67ad953c443ab68e2
TLSH
T16E31F1A0E44424917798F497D0A67E45B839723A85C1FCC552F8ED8C27C2291EFCAA74
MD5 SHA1 SHA512 TLSH

Submit Download

list-general-user.txt

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\lists\list-general-user.txt
Size 189B
SHA256 fbc17cbcab3b80301f0747275a361753acddf43b29990e5e24303e11b521d00e
MD5 cf9e0cbd41e2a536327caa4422de1b43
SHA1 9b0ac052b9120066872ed1664def36d1c3dcdb35
SHA512 91ae4a1fb7f55e6ebe6a026c3fea4feb657b9ca3873f0d544a65dc11d6ab814b1c52757fd4e862c5951ec5a9ce2320098fb49d044943947bb2c1b31b2bd05f5f
TLSH
T183C022088E90411634A3CA9838383C869B122C279C63F2B41165B319A600C4985F2AC0
MD5 SHA1 SHA512 TLSH

Submit Download

list-general.txt

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\lists\list-general.txt
Size 1KB
SHA256 9ff3ae9e4bf0edbcf8fecb1bba7aac951aace2036cdb732ec3ef65dfc6db443b
MD5 316adb4bdd3c1e3418dc1627c1129794
SHA1 0b765481aa45b883dcb5181787b9756f9b812819
SHA512 d63361b654aebe85bf59f3c8c2d22b77e952e846a0d6b185a5dc7361567ae2dc8bee18a04d02a680b430f58e8521d6fe1919fd99d91c76c3f14d4b93a22cee1d
TLSH
T13E113356A1A997102B1DD0E4245422A02380B4B418CFE6E39B6FC19F490D3FEB3C0AA7
MD5 SHA1 SHA512 TLSH

Submit Download

list-google.txt

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\lists\list-google.txt
Size 453B
SHA256 4104b8f5119f76a3642e3176987bbcf817d98daa4899a7ecf9ee2c254958e33b
MD5 2d099c8547925f13d6ab23dc2ccd8f19
SHA1 ba822130389f13343a6f0a711962fafccb809173
SHA512 e8b82795d202e52e93c63894404ac3b8afdca677e0ff1836314655e22cb81f16b991ffc3aff80cacbe81c81dfa2bfac8f837a3cd5ec658b3dd9e1674b96468a4
TLSH
T116F0ED87780EC09F5202E9C818F06549B62CF23586D9E6F4DD61D07E60ADB4635C18E2
MD5 SHA1 SHA512 TLSH

Submit Download

service.bat

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\service.bat
Size 4KB
SHA256 697573a2f6f3a32cc06a6ea8ba22718bd8997f14d12973076dd61c632df738d0
MD5 37a341215ec8e7621c3090d23ca38b7d
SHA1 57025f2bd96e33fb618b5e11ddc75c718595ae56
SHA512 d3885ca2ea7d9a50190dc6645b32ed34be114f0c5432ce4b46e069ffc6ef22aa7238248ddcd6869c237d65d337421edc82fb20bc42e08f7eb61eecbcf52f049a
SSDEEP 96:6D0kf6R4YqB4EDwJm+l+PfPub+lmNS+Nv0+s2VqHswaJWxrJWEyKnDvTsocNx:hR4YqB4EsJmaP6rc0h2VqMwaJWFJWEyZ
TLSH
T1F691BAF4C8042502CEF121BFF2478995E67AA5D38A56969D3E1440473B3F693CCEE2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game_filter.enabled

Path C:\Users\Admin\AppData\Local\Temp\ZapretTrayUpdate\x\files\core\utils\game_filter.enabled
Size 5B
SHA256 9e3dbe0a16e58797ba9b8d0ff475dc0dbb5fbcab8b5c9e9f39daec57fad121b9
MD5 71b1b880448ff68b9fe6d850e29e74b1
SHA1 109175b8db620da1a06be64f4ddf9c1a8bc70e3b
SHA512 251f56f4dbe8b31e3eb8ef93c36a7edcdef86ff045c8b3f55e081cce90b42a367f2be291fc73f961f7495302417f25988ad7efb9e6c4420984ce43491b7d2d08
MD5 SHA1 SHA512

Submit Download

list-exclude-user.txt.tmp

Path C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt.tmp
Size 127B
SHA256 1927aecc32d04f0b507fd17ae5624ca241dd81ffad9ad5fa1589311a1a5e9938
MD5 f11574a3ab96a607bfc379ed986c7e06
SHA1 798a9257414d4f869772db76773834e68f902962
SHA512 f5dc0e686167553d47c923eff6a696a08b5c77c5f21e05dcb67ec201454e0650768c7683bcca41e8023cdf15276dfe157a69f44d03a644517c06197e7816cf8c
TLSH
T159B09B618050105D3D4270136D0C454575ED55FB2C779201555014EE3956531C074F2A
MD5 SHA1 SHA512 TLSH

Submit Download

best_config.txt

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\best_config.txt
Size 33B
SHA256 bb2975109646ea04b8bd7782eb2f31cd4297c49162061b1b229a53a36a3ed14c
MD5 0808efb4b4a6ee2e0f0a2c1b4278d24e
SHA1 b1d99dac74a250d84eca8a8f2fd499858340a1b1
SHA512 22263b2f3c1ad7a53eab5bc9d0b6271b63f7b89a649a0f886d5414138de70f5e8092afd98a93fbcd7236cbc2a106b2f76ae9e3e76872bc145926141145933186
MD5 SHA1 SHA512

Submit Download

tray.ini

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\tray.ini
Size 46B
SHA256 d10304958758b55e643bf89f3ab5ddfa73e216e4f56cde8bdf086114be5f9bd3
MD5 e273d303623136e5392009790f92591e
SHA1 cac8052d1328ca78cfa8a1439ade588827b46d6f
SHA512 e2328146a20cdd3f04ed5664780a7952c5ce68ded0a271214f7a8e2a870ddabde828bf22d4bc19ffd440731b35e1f410cee18b133ddcf242428373cf328f9b87
MD5 SHA1 SHA512

Submit Download

tray.log

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\tray.log
Size 153B
SHA256 cc1296b7412c7cdf5bf6954ceeb48dd7f38e7b5bf8c7c5dd1272ca9d168c2519
MD5 9b9cb91a09a6fc9138c15b58c1ba5aca
SHA1 ab00a5df20c5bc0a4270ef82d913bc604eb67bab
SHA512 25b51031250b5a1185394af5ba1f5a3e27ab271aa857f7887c04b182c85c187f99c7e8cf1cab6cdd869d168f8356e4c60accefb26b0a3d4dd0d734b06e9ad888
TLSH
T198C08C33E24810662B09C22BD5B84A4A608A05FE613A6289BA60D84E80A18346A1A2D0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-351-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/696-355-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/696-352-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1112-62-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/1112-61-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1112-60-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/1484-12-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/1484-14-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/1484-16-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/1484-13-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1768-107-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1768-110-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/1876-116-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1876-119-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2000-357-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/2000-358-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2000-361-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/2004-54-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2004-50-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2004-51-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2436-90-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2436-88-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2436-89-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2556-80-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2556-81-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2556-79-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2560-106-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2560-102-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2560-103-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2664-127-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2664-124-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2664-123-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2836-74-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2836-78-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/2836-75-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2940-344-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/2940-342-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2940-341-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/3076-346-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/3076-347-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3076-350-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/3164-332-0x0000000000EA0000-0x0000000000EE4000-memory.dmp

Download

memory/3192-115-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3192-112-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3192-111-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3332-373-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/3332-370-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3332-369-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/3420-37-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3420-38-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3420-36-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3552-68-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3552-64-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3552-65-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3804-98-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3804-101-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/3804-97-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4072-56-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4072-55-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4072-59-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4180-363-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/4180-364-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4180-367-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/4376-30-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4376-27-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4376-26-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4492-83-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4492-87-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4492-84-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4640-46-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4640-45-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4640-49-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4788-96-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4788-93-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4788-92-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4812-31-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4812-32-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4812-35-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/4896-5-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-132-0x00000000014F0000-0x0000000001502000-memory.dmp

Download

memory/4896-4-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-3-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-2-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-1-0x00000000004E0000-0x00000000004FA000-memory.dmp

Download

memory/4896-7-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-9-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-10-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-11-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-0-0x00007FFA371CF000-0x00007FFA371D0000-memory.dmp

Download

memory/4896-17-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-130-0x00000000014C0000-0x00000000014CA000-memory.dmp

Download

memory/4896-23-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-266-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-6-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-18-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-25-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/4896-24-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5008-44-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/5008-41-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5008-40-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/5024-265-0x0000000000980000-0x0000000000998000-memory.dmp

Download

memory/5808-375-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/5808-376-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5808-379-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/5932-19-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5932-22-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/6048-69-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/6048-70-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/6048-73-0x00007FFA323E0000-0x00007FFA326E2000-memory.dmp

Download

memory/6104-381-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download

memory/6104-382-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/6104-383-0x00007FFA32270000-0x00007FFA32572000-memory.dmp

Download