G12clean.exe drops XOR 0xAB-decoded kernel driver payload (drv.sys / anticheatG13.sys)
Detects G12clean.exe creating a kernel driver file (drv.sys or anticheatG13.sys) while its own command line references the XOR key 0xAB, consistent with decoding and dropping an obfuscated driver payload.
Microsoft Sentinel (KQL)
