dced936739574375ff5fc0b6b21910759d6fff456d11095f289ec0aa645bd752

Analysis

max time kernel
3s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files\ZapretTray.exe
Size 276KB
Sample261107-1pgwsavyc1
SHA256 dced936739574375ff5fc0b6b21910759d6fff456d11095f289ec0aa645bd752
MD5 651cb640c0e86ce90cd7757e55e46be3
SHA1 beaac06d7d6ed6b21db8822db71fc896eef13f42
SHA512 8f5cbfbe49bd007f3c232f3096c8f031b629929f973b82e127b2064c186994f43c3b70cfef103324f06e9615e37d21f2422c5f00481e00265f9fd7030beca6d0
SSDEEP 6144:3Rlv1fAD3+6gtzkBDtc7GPgZstWgtrD5wge:3Jf8gm+VurD+
TLSH
T1C4544B0FB7B98F65FAAE8738807105C18672B307E75EEB485CCB68FC1459371A61126B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
45	discord.com
70	discord.com
76	discord.com
96	discord.com
130	discord.com
150	discord.com
159	discord.com
40	discord.com
57	discord.com
87	discord.com
109	discord.com
117	discord.com
137	discord.com
1	discord.com

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2620	sc.exe
2752	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1500	cmd.exe
3872	cmd.exe
2632	cmd.exe
2520	cmd.exe
4432	cmd.exe
5588	cmd.exe
3156	cmd.exe
4716	cmd.exe
3028	cmd.exe
2928	cmd.exe
1092	cmd.exe
2832	cmd.exe
3412	cmd.exe
2036	cmd.exe
5704	cmd.exe
6120	cmd.exe
2492	cmd.exe
5576	cmd.exe
5344	cmd.exe
3000	cmd.exe
5988	cmd.exe
728	cmd.exe
5116	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZapretTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZapretTray.exe

System Service Discovery 1 TTPs
Adversaries may try to gather information about registered local system services.
discovery

System Service Discovery
T1007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1912	netsh.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	ZapretTray.exe
Token: SeRestorePrivilege	6004	winws.exe
Token: SeBackupPrivilege	6004	winws.exe
Token: SeDebugPrivilege	6004	winws.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe
676	ZapretTray.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 2620	676	ZapretTray.exe	89
PID 676 wrote to memory of 2752	676	ZapretTray.exe	91
PID 676 wrote to memory of 5344	676	ZapretTray.exe	93
PID 5344 wrote to memory of 4424	5344	cmd.exe	163
PID 5344 wrote to memory of 2880	5344	cmd.exe	96
PID 5344 wrote to memory of 4316	5344	cmd.exe	170
PID 5344 wrote to memory of 2780	5344	cmd.exe	98
PID 5344 wrote to memory of 4324	5344	cmd.exe	171
PID 5344 wrote to memory of 1912	5344	cmd.exe	100
PID 5344 wrote to memory of 3528	5344	cmd.exe	176
PID 5344 wrote to memory of 6004	5344	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe
"C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "zapret"
  2⤵
  - Launches sc.exe
  PID:2620
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "zapret"
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4424
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2880
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4316
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2780
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4324
- - C:\Windows\system32\netsh.exe
    netsh interface tcp set global timestamps=enabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:1912
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:2816
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:696
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:5140
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:6032
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:4544
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:5900
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:1048
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:5536
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:4064
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  PID:3000
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5572
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:416
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:2424
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:1464
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2340
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:1116
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:4580
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:1348
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:6096
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:3016
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:4248
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:1204
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:764
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:2460
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:2956
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT3).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2520
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5500
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5528
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1552
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2016
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:1844
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    PID:4684
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:4424
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:1324
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:2148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4324
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:5640
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:1088
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:4316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3528
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:4900
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:4560
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:368
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT4).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5988
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1760
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4452
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:5204
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:3176
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2812
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:2720
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:1160
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:2764
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:1920
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:4308
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:3272
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:2540
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:3912
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:4980
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:2316
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT5).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2928
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2128
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4956
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:2084
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:3132
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3364
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-l3=ipv4 --filter-tcp=80,443,2053,2083,2087,2096,8443 --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=14 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    PID:2392
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:1756
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:5508
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:5244
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:5528
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:6044
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:2640
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:5076
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:4684
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:1600
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT6).bat""
  2⤵
  - Executes a command shell one-liner
  PID:728
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2736
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2868
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1180
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:792
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2040
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:5556
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:4464
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:4208
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:4192
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:4620
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:764
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:2148
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:4064
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:6028
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:1760
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:3724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT7).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5116
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2948
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2616
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:724
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5984
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4612
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=syndata --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:1080
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:2708
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:5976
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:4288
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:3184
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:1392
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:5836
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:5848
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:2724
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:2624
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT8).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3472
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5636
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2648
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:1312
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:2736
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:864
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:908
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:5312
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:1524
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:2280
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:5024
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:3660
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:4368
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:1300
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT9).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1500
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3136
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2848
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:4544
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4124
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:6020
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts,md5sig --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:1876
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:2948
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:2424
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:5484
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:3568
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:3248
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:5980
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:4936
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:4768
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:3532
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:2688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT10).bat""
  2⤵
  - Executes a command shell one-liner
  PID:4432
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3020
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2580
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:3472
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5072
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4620
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=none --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:416
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT11).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5588
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5356
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2096
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:924
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2764
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4052
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    PID:1756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT12).bat""
  2⤵
  - Executes a command shell one-liner
  PID:3156
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4716
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3740
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:4976
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2260
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2776
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=3 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    PID:3016
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:5076
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:2632
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:2604
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:1324
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:2548
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:2912
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:3356
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:3896
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:5952
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:5864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT13).bat""
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5796
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5596
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1924
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4552
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:432
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=5 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=7 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=mail.ru,altorder=1 --dpi-desync-repeats=5 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=mail.ru,altorder=1 --dpi-desync-repeats=5 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=mail.ru,altorder=1 --dpi-desync-repeats=5 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_sochi_park.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    PID:3020
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (EXP).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2832
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4320
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2752
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:2352
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2960
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3412
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-l7=quic --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun,unknown --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=4 --dpi-desync-cutoff=n4 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=480 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=4 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --hostlist-exclude-domains=fonts.googleapis.com --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=480 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=4 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=5 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_4pda_to.bin" --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n4
    3⤵
    PID:5312
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:3644
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:2444
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:3560
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:4236
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:2460
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:1668
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:2496
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:4292
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:4572
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:1012
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT).bat""
  2⤵
  - Executes a command shell one-liner
  PID:3872
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1128
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1640
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:792
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4308
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2640
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-repeats=8 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:5528
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  PID:6120
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2860
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3352
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:4980
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:1616
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:248
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=10000000 --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:3036
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:4632
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:4508
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:4956
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:200
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:6036
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:3176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:3344
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:5840
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:5520
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:5428
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO ALT3).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2632
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2452
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:368
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1076
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:3356
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2604
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5884
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (FAKE TLS AUTO).bat""
  2⤵
  - Executes a command shell one-liner
  PID:3412
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2424
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5852
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:3308
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4160
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:1008
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown=0x00000000 --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:5900
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (SIMPLE FAKE ALT).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2492
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5880
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4196
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1676
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5980
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:4392
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (SIMPLE FAKE ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  PID:2036
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1588
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1128
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:1640
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2620
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:2464
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n5 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    PID:5700
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (SIMPLE FAKE).bat""
  2⤵
  - Executes a command shell one-liner
  PID:4716
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6000
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2448
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:3944
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:1672
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3212
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun2.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    PID:3016
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general.bat""
  2⤵
  - Executes a command shell one-liner
  PID:3028
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3364
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3556
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:4588
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:4924
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3036
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:5544
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:1924
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:5776
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:696
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:5624
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:5008
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:5432
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:5524
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:1460
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:5476
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:5760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT9).bat""
  2⤵
  - Executes a command shell one-liner
  PID:5576
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5568
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5868
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    PID:4144
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:2588
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5428
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts,md5sig --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=hostfakesplit --dpi-desync-repeats=4 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=ozon.ru --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    PID:3004
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:5888
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:1764
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /tn "ZapretTray Autostart" /xml
  2⤵
  PID:4052

C:\Users\Admin\AppData\Local\Temp\files\core\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\files\core\bin\WinDivert64.sys
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Service Discovery

T1007

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

best_config.txt

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\best_config.txt
Size 20B
SHA256 a2b7ed41d32e4ee2bae7579c8bb17f78d397c610a61c3163f48999b49a54caa0
MD5 05d30d8905b270034ac5422079af2f1c
SHA1 933b4f3acd76c2e8a9cfd9aadc10ce009af4a8ab
SHA512 baa52dbc337ed0a5cae49cd1111d5c821866aef6e7055c0da237f6cba3e521e650f3614de3b5dd8970869547c0f8fa344e98dbc0213b9f09629b5d2a9f772ca1
MD5 SHA1 SHA512

Submit Download

graphs.txt

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\graphs.txt
Size 2KB
SHA256 ba7c3df062a8977dd75373343f44403e8ef63e8167cde5d151e98baa096f36f1
MD5 37b7bdc26321da624820e15fa8116bba
SHA1 e23d689d176e07340157153c201fe277107aa1ad
SHA512 24322e40e66d0e896e54ca6361172ce51449ded22e8579d470b69f645983ce1cfd0f95a5b0f3510532aa9fd59a6cda65233cc3bd3e768b750df017c2497d95a4
TLSH
T18F51D2BC5F4E50574AF23CA848E89699CE3B525F8DDA400DB09C58291EC7B6EDBC6CD0
MD5 SHA1 SHA512 TLSH

Submit Download

graphs.txt.tmp

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\graphs.txt.tmp
Size 3KB
SHA256 c599f02f27b6d7577429dff7d08fcb9aeadc60f2873961926a5839ef9cca2f19
MD5 6d7dbf6004fae21410f7138416fef541
SHA1 efcc1a4a48ef43c12184e1d9bbc9a2c561fa1e76
SHA512 0b5aa1799bc96badf2df49fac28dae5c86c7887545bb0ef4f3a218f9e88653924272d60b3810ad05b587a9c8b20273a1c18b5b8fdaca32ca75e43718764fa826
TLSH
T13461CFBC2F4E414649F13DA514F89698CE3B525F8DDA400E709E492A2ECBB2D9BC3CD0
MD5 SHA1 SHA512 TLSH

Submit Download

tray.log

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\tray.log
Size 6KB
SHA256 0c610ff2e8c1273a9dbc4cd23da08addef9fb7cbaf79567437dbef8d4bfcfbae
MD5 79dc99591f8d90987403d836d208bc99
SHA1 f3ebb6aa71f3a8606c3e6df5cee90011d42655ed
SHA512 a77ea97cc4c5a8f265aa96c1113f2f6d979604b6b9925bfb0d5c7f91df69adc366a0a0c9c533b31a65f4e82de4bd38119a767fbc6af274c1abaebb5aa7c1621b
SSDEEP 48:92sG4M8MKtw878IE8kJo8i8k8Io8ETVMR8MKtw878IE8kJo8i8k8Io8EdH8MKtwW:9FmLZ0L1LoL7LJLeL9LCt
TLSH
T122D10B83569D95F6BB04D9CFD901B20E288290EEF5DFC1CF560C7C76B2DA0A5066EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-74-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/416-71-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/676-35-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-37-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-11-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-13-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-14-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-15-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-16-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-7-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-6-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-5-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-1-0x0000000000B90000-0x0000000000BDA000-memory.dmp

Download

memory/676-2-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-3-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-8-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-30-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/676-0-0x00007FFE8D00F000-0x00007FFE8D010000-memory.dmp

Download

memory/676-29-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/1080-56-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1080-59-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/1080-55-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/1116-26-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/1116-25-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1116-24-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/1756-75-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/1756-76-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1756-79-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/1876-66-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1876-69-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/2392-45-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2392-48-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/2392-44-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/2720-38-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/2720-39-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2720-42-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/2736-62-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2736-63-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/2736-61-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3004-144-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3004-146-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3004-145-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3016-80-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3016-132-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3016-133-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3016-84-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3016-83-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3016-85-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3016-87-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3016-88-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3020-92-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3020-91-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3020-93-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3036-109-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3036-105-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/3036-106-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3428-111-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3428-112-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/4260-122-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/4260-126-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/4260-123-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4684-31-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4684-34-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5312-95-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5312-96-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5312-97-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5528-100-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5528-101-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5528-104-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5544-135-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5544-138-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5556-52-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5556-51-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5556-50-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5700-127-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5700-128-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5700-131-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5900-118-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/5900-115-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5900-114-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/6004-19-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/6004-22-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download

memory/6004-20-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/6004-18-0x00007FFE8F1B0000-0x00007FFE8F4B2000-memory.dmp

Download