gurcu | 9c98b2eda2195c59d09c7ca75ee6aee2d3fdcd2a8af1d0a6d6c98149e73c11d1

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Minecraft_Client_1.21.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\	java.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Minecraft_Client_1.21.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	java.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4100	timeout.exe
2372	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133737441293896029"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	java.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Apollo_Launcher.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\TL-Legacy-Launcher-Windows.exe:Zone.Identifier	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2116	schtasks.exe
3584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
4700	msedge.exe
4700	msedge.exe
4280	msedge.exe
4280	msedge.exe
2944	identity_helper.exe
2944	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
3924	Minecraft_Client_1.21.1.exe
5016	chrome.exe
5016	chrome.exe
2388	chrome.exe
2388	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4844	TL-Legacy-Launcher-Windows.tmp
4844	TL-Legacy-Launcher-Windows.tmp
1500	powershell.exe
1500	powershell.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe
2636	Minecraft_Client_1.21.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	3924	Minecraft_Client_1.21.1.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe
2388	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2060	java.exe
2060	java.exe
2852	TLauncher-Installer-1.5.3.exe
4744	irsetup.exe
4744	irsetup.exe
4744	irsetup.exe
4744	irsetup.exe
4744	irsetup.exe
2680	TLauncher-Installer-1.5.3.exe
3000	irsetup.exe
3000	irsetup.exe
3000	irsetup.exe
3000	irsetup.exe
3000	irsetup.exe
2572	java.exe
2572	java.exe
2012	java.exe
2012	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3800	4700	msedge.exe	80
PID 4700 wrote to memory of 3800	4700	msedge.exe	80
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3844	4700	msedge.exe	81
PID 4700 wrote to memory of 3140	4700	msedge.exe	82
PID 4700 wrote to memory of 3140	4700	msedge.exe	82
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83
PID 4700 wrote to memory of 1092	4700	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0c4e3cb8,0x7ffd0c4e3cc8,0x7ffd0c4e3cd8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,17208196051032151967,6833262555037648967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Apollo_Launcher\start.bat" "
1⤵
PID:3160
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:3360
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:856
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "AddDefenderExclusionTask"
  2⤵
  PID:4120
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "AddDefenderExclusionTask" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" /sc once /st 00:00 /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3584
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn "AddDefenderExclusionTask"
  2⤵
  PID:1688
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4100
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "AddDefenderExclusionTask" /f
  2⤵
  PID:2636
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar Apollo.jar
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp2536.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp2536.tmp.bat
      4⤵
      PID:936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcf9d4cc40,0x7ffcf9d4cc4c,0x7ffcf9d4cc58
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2088,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3624,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4548,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4600,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4728,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5000,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5012,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5292,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5304,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3292,i,11007479525315947371,7267927442443695232,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3172
- C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe
  "C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe" "__IRCT:3" "__IRTSS:25260593" "__IRSID:S-1-5-21-2410826464-2353372766-2364966905-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4744

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2132

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\de278c1f5ffc46a2bd992ff69f5df9a2 /t 2260 /p 4744
1⤵
PID:4752

C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe
"C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2680
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-Installer-1.5.3.exe" "__IRCT:3" "__IRTSS:25260593" "__IRSID:S-1-5-21-2410826464-2353372766-2364966905-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3000

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\2d275da8cc51474794d50bfb6298d1fd /t 2856 /p 3000
1⤵
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0x78,0x114,0x7ffcf9d4cc40,0x7ffcf9d4cc4c,0x7ffcf9d4cc58
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1808,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3552,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5032,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:4344
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff614734698,0x7ff6147346a4,0x7ff6147346b0
    3⤵
    - Drops file in Windows directory
    PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4848,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4320,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5212,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3492,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3512,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5692,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5808,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5960,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5968,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5632,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6280,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5780,i,14922330934417552718,11091740150565961690,262144 --variations-seed-version=20241018-050049.137000 --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3464
- C:\Users\Admin\Downloads\TL-Legacy-Launcher-Windows.exe
  "C:\Users\Admin\Downloads\TL-Legacy-Launcher-Windows.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\is-5LSFV.tmp\TL-Legacy-Launcher-Windows.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-5LSFV.tmp\TL-Legacy-Launcher-Windows.tmp" /SL5="$902A2,115841256,1202688,C:\Users\Admin\Downloads\TL-Legacy-Launcher-Windows.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
  - - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe
      "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3512
    - - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe
        
        "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe" -Xmx128m -Dtlauncher.bootstrap.restartExec=TL.exe -jar "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3288
      - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe -Xmx128m -Dfile.encoding=UTF-8 -Dtlauncher.systemCharset=windows-1252 -Dtlauncher.logFolder=C:\Users\Admin\AppData\Roaming\.tlauncher\logs --add-exports java.desktop/sun.awt=javafx.swing -Dtlauncher.bootstrap.restartExec=TL.exe -classpath C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar ru.turikhay.tlauncher.bootstrap.Bootstrap --packageMode windows --targetJar launcher/launcher.jar --targetLibFolder launcher/libraries -- --settings tl.properties
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe -cp C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\libraries\ru\turikhay\jvd\1.0\jvd-1.0.jar ru.turikhay.util.jvd.JavaVersionDetectorMain
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4968
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\jre-legacy\windows-x64\jre-legacy\bin\javaw.exe -XX:+DisableExplicitGC -XX:+UseConcMarkSweepGC -XX:-UseAdaptiveSizePolicy -XX:+CMSParallelRemarkEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseCMSInitiatingOccupancyOnly -XX:ConcGCThreads=1 -Xms2048M -Xmx2048M -Dfile.encoding=UTF-8 -Dlog4j.configurationFile=C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\assets\log_configs\patched-variant-2.0.xml -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.useSystemProxies=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump "-Dos.name=Windows 10" -Dos.version=10.0 "-Djava.library.path=C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\versions\Forge 1.8.9\natives" -Dminecraft.launcher.brand=java-minecraft-launcher -Dminecraft.launcher.version=1.6.84-j "-Dminecraft.client.jar=C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\versions\Forge 1.8.9\Forge 1.8.9.jar" -cp "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\turikhay\ca-fixer\1.0\ca-fixer-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\minecraftforge\forge\1.8.9-11.15.1.2318-1.8.9\forge-1.8.9-11.15.1.2318-1.8.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\minecraft\launchwrapper\1.12\launchwrapper-1.12.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\ow2\asm\asm-all\5.0.3\asm-all-5.0.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\jline\jline\2.13\jline-2.13.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\typesafe\akka\akka-actor_2.11\2.3.3\akka-actor_2.11-2.3.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\typesafe\config\1.2.1\config-1.2.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-actors-migration_2.11\1.1.0\scala-actors-migration_2.11-1.1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-compiler\2.11.1\scala-compiler-2.11.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\plugins\scala-continuations-library_2.11\1.0.2\scala-continuations-library_2.11-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\plugins\scala-continuations-plugin_2.11.1\1.0.2\scala-continuations-plugin_2.11.1-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-library\2.11.1\scala-library-2.11.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-parser-combinators_2.11\1.0.1\scala-parser-combinators_2.11-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-reflect\2.11.1\scala-reflect-2.11.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-swing_2.11\1.0.1\scala-swing_2.11-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\scala-lang\scala-xml_2.11\1.0.2\scala-xml_2.11-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\lzma\lzma\0.0.1\lzma-0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\sf\jopt-simple\jopt-simple\4.6\jopt-simple-4.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\java3d\vecmath\1.5.2\vecmath-1.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\sf\trove4j\trove4j\3.0.3\trove4j-3.0.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\ru\tlauncher\patchy\1.0.0\patchy-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\java\dev\jna\jna\3.4.0\jna-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\paulscode\codecwav\20101023\codecwav-20101023.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\paulscode\libraryjavasound\20101123\libraryjavasound-20101123.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\paulscode\soundsystem\20120107\soundsystem-20120107.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\io\netty\netty-all\4.0.23.Final\netty-all-4.0.23.Final.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\google\guava\guava\17.0\guava-17.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\apache\commons\commons-lang3\3.3.2\commons-lang3-3.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\commons-io\commons-io\2.4\commons-io-2.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\google\code\gson\gson\2.2.4\gson-2.2.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\by\ely\authlib\3.11.49.2\authlib-3.11.49.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\com\mojang\realms\1.7.59\realms-1.7.59.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\apache\commons\commons-compress\1.8.1\commons-compress-1.8.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\commons-logging\commons-logging\1.1.3\commons-logging-1.1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\apache\logging\log4j\log4j-api\2.0-beta9\log4j-api-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\apache\logging\log4j\log4j-core\2.0-beta9\log4j-core-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\lwjgl\lwjgl\lwjgl\2.9.4-nightly-20150209\lwjgl-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.4-nightly-20150209\lwjgl_util-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\libraries\tv\twitch\twitch\6.5\twitch-6.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\versions\Forge 1.8.9\Forge 1.8.9.jar" -Xss2M net.minecraft.launchwrapper.Launch --username rfg345 --version "Forge 1.8.9" --gameDir C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game --assetsDir C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\game\assets --assetIndex 1.8 --uuid 18542cce95363f0ea184a2b1fbc478d0 --accessToken 18542cce95363f0ea184a2b1fbc478d0 --userProperties {} --userType legacy --tweakClass net.minecraftforge.fml.common.launcher.FMLTweaker --width 925 --height 530
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2452

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Apollo_Launcher\start.bat" "
1⤵
PID:852
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:2348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:800
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "AddDefenderExclusionTask"
  2⤵
  PID:4652
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "AddDefenderExclusionTask" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" /sc once /st 00:00 /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2116
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn "AddDefenderExclusionTask"
  2⤵
  PID:5080
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2372
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "AddDefenderExclusionTask" /f
  2⤵
  PID:3188
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar Apollo.jar
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    C:\Users\Admin\AppData\Local\Temp\Minecraft_Client_1.21.1\Minecraft_Client_1.21.1.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery