sheetrat | 871932d648cac13509b3584cb7079bd030273d18cb9c22d52ec055ebdf38ebbf

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4872	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
7424	schtasks.exe
7804	schtasks.exe
4644	schtasks.exe
1752	schtasks.exe
5796	schtasks.exe
5244	schtasks.exe
4364	schtasks.exe
7364	schtasks.exe
7608	schtasks.exe
1860	schtasks.exe
6876	schtasks.exe
5164	schtasks.exe
2404	schtasks.exe
4500	schtasks.exe
5756	schtasks.exe
4264	schtasks.exe
7316	schtasks.exe
4612	schtasks.exe
260	schtasks.exe
3804	schtasks.exe
3432	schtasks.exe
1432	schtasks.exe
3056	schtasks.exe
3468	schtasks.exe
7172	schtasks.exe
3052	schtasks.exe
1136	schtasks.exe
6972	schtasks.exe
2804	schtasks.exe
4252	schtasks.exe
4212	schtasks.exe
2592	schtasks.exe
436	schtasks.exe
3108	schtasks.exe
2952	schtasks.exe
1200	schtasks.exe
6572	schtasks.exe
6308	schtasks.exe
6432	schtasks.exe
6876	schtasks.exe
4588	schtasks.exe
1056	schtasks.exe
920	schtasks.exe
236	schtasks.exe
2064	schtasks.exe
3832	schtasks.exe
436	schtasks.exe
6820	schtasks.exe
3840	schtasks.exe
4596	schtasks.exe
7748	schtasks.exe
6056	schtasks.exe
5420	schtasks.exe
5252	schtasks.exe
3116	schtasks.exe
1184	schtasks.exe
5488	schtasks.exe
1156	schtasks.exe
2116	schtasks.exe
7416	schtasks.exe
2428	schtasks.exe
3804	schtasks.exe
5520	schtasks.exe
3764	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6084	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	5896	aefd510d_.exe
Token: SeDebugPrivilege	1544	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	1544	MalwareDef.exe
Token: SeDebugPrivilege	3668	MalwareDef.exe
Token: SeDebugPrivilege	560	MalwareDef.exe
Token: SeDebugPrivilege	5460	MalwareDef.exe
Token: SeDebugPrivilege	5480	MalwareDef.exe
Token: SeDebugPrivilege	5816	MalwareDef.exe
Token: SeDebugPrivilege	4200	MalwareDef.exe
Token: SeDebugPrivilege	204	MalwareDef.exe
Token: SeDebugPrivilege	1084	MalwareDef.exe
Token: SeDebugPrivilege	264	MalwareDef.exe
Token: SeDebugPrivilege	4484	MalwareDef.exe
Token: SeDebugPrivilege	600	MalwareDef.exe
Token: SeDebugPrivilege	5832	taskmgr.exe
Token: SeSystemProfilePrivilege	5832	taskmgr.exe
Token: SeCreateGlobalPrivilege	5832	taskmgr.exe
Token: 33	5832	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5832	taskmgr.exe
Token: SeDebugPrivilege	2312	taskmgr.exe
Token: SeSystemProfilePrivilege	2312	taskmgr.exe
Token: SeCreateGlobalPrivilege	2312	taskmgr.exe
Token: SeDebugPrivilege	1480	MalwareDef.exe
Token: SeDebugPrivilege	3596	MalwareDef.exe
Token: SeDebugPrivilege	4132	MalwareDef.exe
Token: SeDebugPrivilege	4948	MalwareDef.exe
Token: SeDebugPrivilege	1892	MalwareDef.exe
Token: SeDebugPrivilege	5444	MalwareDef.exe
Token: SeDebugPrivilege	1568	MalwareDef.exe
Token: SeDebugPrivilege	1860	MalwareDef.exe
Token: SeDebugPrivilege	4252	MalwareDef.exe
Token: SeDebugPrivilege	5576	MalwareDef.exe
Token: SeDebugPrivilege	3504	MalwareDef.exe
Token: SeDebugPrivilege	5968	MalwareDef.exe
Token: SeDebugPrivilege	5300	MalwareDef.exe
Token: SeDebugPrivilege	124	MalwareDef.exe
Token: SeDebugPrivilege	3108	MalwareDef.exe
Token: SeDebugPrivilege	252	MalwareDef.exe
Token: SeDebugPrivilege	6052	MalwareDef.exe
Token: SeDebugPrivilege	4688	MalwareDef.exe
Token: SeDebugPrivilege	2252	MalwareDef.exe
Token: SeDebugPrivilege	5680	MalwareDef.exe
Token: SeDebugPrivilege	5756	MalwareDef.exe
Token: SeDebugPrivilege	5648	MalwareDef.exe
Token: SeDebugPrivilege	5196	MalwareDef.exe
Token: SeDebugPrivilege	1636	MalwareDef.exe
Token: SeDebugPrivilege	436	MalwareDef.exe
Token: SeDebugPrivilege	5284	MalwareDef.exe
Token: SeDebugPrivilege	4216	MalwareDef.exe
Token: SeDebugPrivilege	1580	MalwareDef.exe
Token: SeDebugPrivilege	3024	MalwareDef.exe
Token: SeDebugPrivilege	3648	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4132	MalwareDef.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
5832	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe
2312	taskmgr.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
6084	EXCEL.EXE
5832	taskmgr.exe
2312	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 2004	5896	aefd510d_.exe	90
PID 5896 wrote to memory of 3456	5896	aefd510d_.exe	91
PID 3456 wrote to memory of 4236	3456	cmd.exe	94
PID 5896 wrote to memory of 3708	5896	aefd510d_.exe	95
PID 3708 wrote to memory of 1704	3708	cmd.exe	97
PID 5896 wrote to memory of 1544	5896	aefd510d_.exe	98
PID 1544 wrote to memory of 2304	1544	MalwareDef.exe	99
PID 2304 wrote to memory of 5484	2304	cmd.exe	101
PID 1544 wrote to memory of 1392	1544	MalwareDef.exe	102
PID 1392 wrote to memory of 5576	1392	cmd.exe	104
PID 1544 wrote to memory of 3952	1544	MalwareDef.exe	105
PID 3952 wrote to memory of 604	3952	cmd.exe	107
PID 1544 wrote to memory of 108	1544	MalwareDef.exe	108
PID 108 wrote to memory of 236	108	cmd.exe	110
PID 1544 wrote to memory of 4080	1544	MalwareDef.exe	111
PID 4080 wrote to memory of 5364	4080	cmd.exe	113
PID 1544 wrote to memory of 4788	1544	MalwareDef.exe	114
PID 4788 wrote to memory of 5252	4788	cmd.exe	116
PID 1544 wrote to memory of 6120	1544	MalwareDef.exe	117
PID 6120 wrote to memory of 2428	6120	cmd.exe	119
PID 1544 wrote to memory of 972	1544	MalwareDef.exe	120
PID 972 wrote to memory of 3804	972	cmd.exe	122
PID 1544 wrote to memory of 724	1544	MalwareDef.exe	124
PID 724 wrote to memory of 3724	724	cmd.exe	126
PID 1544 wrote to memory of 2500	1544	MalwareDef.exe	127
PID 2500 wrote to memory of 2064	2500	cmd.exe	129
PID 1544 wrote to memory of 1244	1544	MalwareDef.exe	130
PID 1244 wrote to memory of 5164	1244	cmd.exe	132
PID 1544 wrote to memory of 2708	1544	MalwareDef.exe	133
PID 2708 wrote to memory of 2404	2708	cmd.exe	135
PID 1544 wrote to memory of 3492	1544	MalwareDef.exe	136
PID 3492 wrote to memory of 5508	3492	cmd.exe	138
PID 1544 wrote to memory of 4256	1544	MalwareDef.exe	139
PID 4256 wrote to memory of 3832	4256	cmd.exe	141
PID 1544 wrote to memory of 2376	1544	MalwareDef.exe	142
PID 2376 wrote to memory of 4644	2376	cmd.exe	144
PID 1544 wrote to memory of 5380	1544	MalwareDef.exe	145
PID 5380 wrote to memory of 2568	5380	cmd.exe	147
PID 1544 wrote to memory of 1300	1544	MalwareDef.exe	148
PID 1300 wrote to memory of 5520	1300	cmd.exe	150
PID 1544 wrote to memory of 3408	1544	MalwareDef.exe	151
PID 3408 wrote to memory of 1752	3408	cmd.exe	153
PID 1544 wrote to memory of 1424	1544	MalwareDef.exe	157
PID 1424 wrote to memory of 4168	1424	cmd.exe	159
PID 1544 wrote to memory of 2824	1544	MalwareDef.exe	160
PID 2824 wrote to memory of 940	2824	cmd.exe	162
PID 1544 wrote to memory of 1980	1544	MalwareDef.exe	174
PID 1544 wrote to memory of 2484	1544	MalwareDef.exe	176
PID 1980 wrote to memory of 2592	1980	cmd.exe	178
PID 2484 wrote to memory of 3804	2484	cmd.exe	179
PID 1544 wrote to memory of 5636	1544	MalwareDef.exe	180
PID 1544 wrote to memory of 1944	1544	MalwareDef.exe	182
PID 5636 wrote to memory of 2316	5636	cmd.exe	184
PID 1944 wrote to memory of 1056	1944	cmd.exe	185
PID 5460 wrote to memory of 4592	5460	MalwareDef.exe	187
PID 560 wrote to memory of 3716	560	MalwareDef.exe	190
PID 3668 wrote to memory of 5624	3668	MalwareDef.exe	188
PID 5460 wrote to memory of 2856	5460	MalwareDef.exe	192
PID 4200 wrote to memory of 2060	4200	MalwareDef.exe	191
PID 264 wrote to memory of 624	264	MalwareDef.exe	193
PID 560 wrote to memory of 5240	560	MalwareDef.exe	201
PID 5816 wrote to memory of 1272	5816	MalwareDef.exe	200
PID 1084 wrote to memory of 5700	1084	MalwareDef.exe	196
PID 204 wrote to memory of 4656	204	MalwareDef.exe	197

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\aefd510d_.exe
"C:\Users\Admin\AppData\Local\Temp\aefd510d_.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="QgpyLtMjLpV]LN" dir=in action=allow program="C:\Windows\Sub\MalwareDef.exe" enable=yes & exit
  2⤵
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4236
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1704
- C:\Windows\Sub\MalwareDef.exe
  "C:\Windows\Sub\MalwareDef.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:5484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:5576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:604
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:5364
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:3724
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5164
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:5508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4644
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:2568
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:4168
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:940
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5636
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:2316
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:5564
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:5952
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4500
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:1464
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2532
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:5296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:4684
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:1004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:1020
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:2236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:4644
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:884
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:5620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:5540
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:3396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:1420
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3F5C.tmp.bat""
    3⤵
    PID:4084
  - - C:\Windows\system32\timeout.exe
      timeout 10 "C:\Windows\Sub"DEL "MalwareDef.exe" /f /qCD "C:\Windows\Sub"DEL "WindowsUpdate.exe" /f /qCD "C:\Users\Admin\AppData\Local\Temp"DEL "tmp3F5C.tmp.bat" /f /q
      4⤵
      Delays execution with timeout.exe
      PID:4872

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\BlockPing.xlsx"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6084

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5624
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3116
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5000
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5688

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1272
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5420

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3716
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5240
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5480
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:604
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4364
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1700
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4592
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2856
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:600
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2320
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2952

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2060
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2432
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5756

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:624
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2644
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5020

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4656
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2080
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2468

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3180
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:468

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5700
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3196
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:252

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5760

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6192
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6412
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3232

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1480
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6200
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6820
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6716
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:260

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5924
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3808
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7292
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7572
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7624
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7660
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7712
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7764
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7880
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7920

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6280
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6584
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2236

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5444
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6368
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6736
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2952

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6352
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6392
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7000
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2748

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5300
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6288
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6684
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6692

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6296
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5948

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1568
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6376
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6592
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6660

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6272
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5776
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6420
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1432

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6624
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6860
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1156

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6252
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6784
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5484

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6324
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6536
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3840

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6220
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6568
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4264

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6400
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4596
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6748
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1116

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6384
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6808
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3928

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1884
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6844
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2164
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7324

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1912
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7364
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5096
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7424

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6896
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7172

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5284
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5364
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5676
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6876

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1636
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3280
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1136

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6348
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6308

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3876
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7300

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5212
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4280
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7356

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1984
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3576
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6432

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2212
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5620
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7240

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5132
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2116
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2316
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7348

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4192
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4088
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7416

C:\Windows\Sub\MalwareDef.exe
"C:\Windows\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1436
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery