Analysis
- max time kernel
699s - max time network
711s - platform
windows10-2004_x64 - resource
win10v2004-20240508-es - resource tags
- submitted
02/07/2024, 21:12
General
- Target Battly-Launcher-Windows.exe
- Size 183.1MB
- Sample240702-z2askazbpb
- SHA256 a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://www.battlylauncher.com
Signatures
- Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 35 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1720,i,13406594923655438293,14944769367463022574,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --mojo-platform-channel-handle=2100 --field-trial-handle=1720,i,13406594923655438293,14944769367463022574,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --app-path="C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2428 --field-trial-handle=1720,i,13406594923655438293,14944769367463022574,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exeC:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exe /A:C "/F:C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Battly Launcher.lnk" "/T:C:\Program Files\Battly Launcher\Battly Launcher.exe" "/I:C:\Program Files\Battly Launcher\resources\app\src\assets\images\icon.ico"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exeC:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exe /A:C "/F:C:\Users\Admin\Desktop\Battly Launcher.lnk" "/T:C:\Program Files\Battly Launcher\Battly Launcher.exe" "/I:C:\Program Files\Battly Launcher\resources\app\src\assets\images\icon.ico"4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c " $battlyFolder = \"C:\Program Files/Battly Launcher\" $battlyPath = \"C:\Program Files/Battly Launcher\Battly Launcher.exe\" $programName = \"Battly Launcher\" $registryKey = \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$programName\" $developer = \"TECNO BROS\" $version = \"1.8.5\" $description = \"El mejor Launcher Personalizado para Minecraft Premium y No premium\" $uninstallCommand = \"$battlyFolder\uninstall.bat\" $website = \"https://www.battlylauncher.com\" $fileSize = (Get-Item $battlyPath).length / 1KB $registryProperties = @{ \"DisplayName\" = $programName \"DisplayIcon\" = $battlyPath \"UninstallString\" = $uninstallCommand \"Publisher\" = $developer \"DisplayVersion\" = $version \"Description\" = $description \"URLInfoAbout\" = $website \"EstimatedSize\" = $fileSize } New-Item -Path $registryKey -Force foreach ($property in $registryProperties.GetEnumerator()) { Set-ItemProperty -Path $registryKey -Name $property.Key -Value $property.Value } Write-Host \"Se ha añadido Battly a la lista de programas correctamente.\" "4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "NET SESSION"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET SESSION4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "NET SESSION"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET SESSION4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION5⤵
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2360,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2704,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=3512,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3960,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3904,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4108,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3484,i,9347752221749840356,15802028023506277629,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=relauncher --no-sandbox --- "C:\Program Files\Battly Launcher\Battly Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2372,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2696,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=3464,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3976,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3992,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://battlylauncher.com/register5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbdd4f46f8,0x7ffbdd4f4708,0x7ffbdd4f47186⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=6124 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=6240 /prefetch:86⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7004 /prefetch:26⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11183768682401440993,16820694259315938143,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:16⤵
-
-
-
C:\Users\Admin\AppData\Roaming\.battly\runtime\jre-16.0.1.9.1-windows-x64\bin\java.exeC:\Users\Admin\AppData\Roaming\.battly\runtime\jre-16.0.1.9.1-windows-x64\bin\java -Xms512M -Xmx1024M -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Dfml.ignoreInvalidMinecraftCertificates=true -Djna.tmpdir=C:/Users/Admin/AppData/Roaming/.battly/versions/1.17/natives -Dorg.lwjgl.system.SharedLibraryExtractPath=C:/Users/Admin/AppData/Roaming/.battly/versions/1.17/natives -Dio.netty.native.workdir=C:/Users/Admin/AppData/Roaming/.battly/versions/1.17/natives -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Djava.library.path=C:/Users/Admin/AppData/Roaming/.battly/versions/1.17/natives -javaagent:authlib-injector.jar=https://api.battlylauncher.com -Dauthlibinjector.mojangAntiFeatures=enabled -Dauthlibinjector.noShowServerName -Dauthlibinjector.disableHttpd -cp C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/blocklist/1.0.5/blocklist-1.0.5.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/patchy/2.1.6/patchy-2.1.6.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/github/oshi/oshi-core/5.7.4/oshi-core-5.7.4.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/net/java/dev/jna/jna/5.8.0/jna-5.8.0.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/net/java/dev/jna/jna-platform/5.8.0/jna-platform-5.8.0.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/slf4j/slf4j-api/1.8.0-beta4/slf4j-api-1.8.0-beta4.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/logging/log4j/log4j-slf4j18-impl/2.14.1/log4j-slf4j18-impl-2.14.1.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/ibm/icu/icu4j/66.1/icu4j-66.1.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/javabridge/1.1.23/javabridge-1.1.23.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/net/sf/jopt-simple/jopt-simple/5.0.3/jopt-simple-5.0.3.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/io/netty/netty-all/4.1.25.Final/netty-all-4.1.25.Final.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/google/guava/guava/21.0/guava-21.0.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/commons/commons-lang3/3.5/commons-lang3-3.5.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/commons-io/commons-io/2.5/commons-io-2.5.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/commons-codec/commons-codec/1.10/commons-codec-1.10.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/net/java/jinput/jinput/2.0.5/jinput-2.0.5.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/net/java/jutils/jutils/1.0.0/jutils-1.0.0.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/brigadier/1.0.18/brigadier-1.0.18.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/datafixerupper/4.0.26/datafixerupper-4.0.26.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/google/code/gson/gson/2.8.0/gson-2.8.0.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/authlib/2.3.31/authlib-2.3.31.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/commons/commons-compress/1.8.1/commons-compress-1.8.1.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/httpcomponents/httpclient/4.3.3/httpclient-4.3.3.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/httpcomponents/httpcore/4.3.2/httpcore-4.3.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/it/unimi/dsi/fastutil/8.2.1/fastutil-8.2.1.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/logging/log4j/log4j-api/2.14.1/log4j-api-2.14.1.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/apache/logging/log4j/log4j-core/2.14.1/log4j-core-2.14.1.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl/3.2.2/lwjgl-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl-jemalloc/3.2.2/lwjgl-jemalloc-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl-openal/3.2.2/lwjgl-openal-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl-opengl/3.2.2/lwjgl-opengl-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl-glfw/3.2.2/lwjgl-glfw-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl-stb/3.2.2/lwjgl-stb-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/org/lwjgl/lwjgl-tinyfd/3.2.2/lwjgl-tinyfd-3.2.2.jar;C:/Users/Admin/AppData/Roaming/.battly/libraries/com/mojang/text2speech/1.11.3/text2speech-1.11.3.jar;C:/Users/Admin/AppData/Roaming/.battly/versions/1.17/1.17.jar net.minecraft.client.main.Main --username etesesesch --version 1.17 --gameDir C:/Users/Admin/AppData/Roaming/.battly --assetsDir C:/Users/Admin/AppData/Roaming/.battly/assets --assetIndex 1.17 --uuid 11d1094691f93d9589e54ecdedd6829a --accessToken 1234 --userType cracked --versionType release5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3352,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3300,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2960,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4664,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4484,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4800,i,18319191612738502669,274537514097445983,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x240 0x4a01⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,6032939643020168279,10474554813061785863,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2104,i,6032939643020168279,10474554813061785863,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:32⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE
license
LICENSE
.nycrc
ValidationMetadataArgs.js.map
ValidationSchema.js.map
ValidationArguments.js.map
ValidatorConstraintInterface.js.map
ValidatorOptions.js.map
ValidationOptions.js
ValidationOptions.js.map
decorators.js
decorators.js.map
index.js
index.js.map
ValidationMetadataArgs.js
convert-to-array.util.js
convert-to-array.util.js.map
get-global.util.js
get-global.util.js.map
index.js
index.js.map
is-promise.util.js
is-promise.util.js.map
ValidationSchema.js
ValidationArguments.js
ValidatorConstraintInterface.js
ValidatorOptions.js
LICENSE.mkd
License
LICENSE
browser-entrypoint.js
has-cors.js
parseqs.js
parseuri.js
yeast.js
globalThis.browser.js
globalThis.js
index.js
package.json
index.js
websocket-constructor.browser.js
websocket-constructor.js
xmlhttprequest.browser.js
xmlhttprequest.js
util.js
LICENSE
LICENSE.BSD
estraverse.js
gulpfile.js
LICENSE
LICENSE
.nycrc
LICENSE
LICENSE
tsconfig.json
LICENSE
instantiation.js
metadata_keys.js
metadata_keys.js.map
interfaces.js
interfaces.js.map
instantiation.js
clonable.js
clonable.js.map
factory_type.js
factory_type.js.map
id.js.map
.editorconfig
.eslintignore
LICENSE
LICENSE
LICENSE
tsconfig.json
LICENSE.md
index.js.LICENSE.txt
package.json
LICENSE
LICENSE
CONTRIBUTING.md
libphonenumber-min.js
AsYouTypeFormatter.PatternParser.js.map
Leniency.test.js.map
utf-8.js.map
formatPhoneNumberForMobileDialing.test.js.map
extractNationalNumberFromPossiblyIncompleteNumber.js.map
metadata.max.json
metadata.max.json.js
metadata.min.json.d.cts
findNumbers.js
findPhoneNumbersInText.js
formatIncompletePhoneNumber.js
getCountries.js
getCountryCallingCode.js
getExampleNumber.js
getExtPrefix.js
isPossiblePhoneNumber.js
isSupportedCountry.js
isValidPhoneNumber.js
parsePhoneNumber.js
parsePhoneNumberWithError.js
searchNumbers.js
searchPhoneNumbersInText.js
validatePhoneNumberLength.js
index.d.cts
index.js
LICENSE
LICENSE
license
semver.js
comparator.js
index.js
range.js
semver.js
clean.js
cmp.js
compare-build.js
compare-loose.js
compare.js
diff.js
eq.js
gt.js
gte.js
inc.js
lt.js
lte.js
major.js
minor.js
neq.js
parse.js
patch.js
prerelease.js
rcompare.js
rsort.js
satisfies.js
sort.js
valid.js
index.js
constants.js
debug.js
identifiers.js
parse-options.js
re.js
preload.js
range.bnf
gtr.js
intersects.js
ltr.js
max-satisfying.js
min-satisfying.js
min-version.js
outside.js
simplify.js
subset.js
to-comparators.js
valid.js
auto.js
.editorconfig
LICENSE
LICENSE
tsconfig.json
protobuf.js
punycode.js
License
browser.js
populate.js
LICENSE
browser-entrypoint.js
backo2.js
on.js
package.json
package.json
binary.js
is-binary.js
package.json
CONTRIBUTING.md
GOVERNANCE.md
LICENSE
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
package.json
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
index.js
package.json
LICENSE
string_decoder.js
package.json
LICENSE
index.js
nil.js
regex.js
validate.js
version.js
browser.js
index.js
constants.js
event-target.js
extension.js
limiter.js
stream.js
subprotocol.js
wrapper.mjs
icon_transparent.png
AZauth.js
Electron.js
NW.js
Terminal.js
Microsoft.js
Mojang.js
Index.js
index.js
fabric.js
forge.js
legacyFabric.js
neoForge.js
quilt.js
patcher.js
Minecraft-Arguments.js
Minecraft-Bundle.js
Minecraft-Loader.js
Minecraft-Lwjgl-Native.js
buffer.js
status.js
Downloader.js
Index.js
types.js
settings.dat
settings.dat
f_000001
f_000004
f_00000e
f_000011
f_000012
f_000014
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity
TransportSecurity~RFe5c0111.TMP
CURRENT
Local State
Local State
Local State
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libegl.dll
libglesv2.dll
es.pak
resources.pak
LICENSE
adm-zip.js
package.json
index.js
package.json
inject.js
LICENSE.md
index.js
package.json
index.js
package.json
index.js
package.json
browser.js
index.js
package.json
package.json
index.js
templates.js
util.js
LICENSE
conversions.js
index.js
package.json
route.js
LICENSE
index.js
package.json
README.markdown
index.js
package.json
index.js
Mime.js
index.js
package.json
other.js
standard.js
package.json
LICENSE
ejs.js
utils.js
package.json
minimatch.js
package.json
package.json
ads.ejs
index.css
icon.ico
background.png
ar.png
de.png
en.png
es.png
fr.png
it.png
jp.png
pt.png
ru.png
opera_banner_es.png
index-es.js
index.js
es.js
eula.txt
eula.ejs
footer.ejs
header.ejs
index.ejs
index.js
install-options.ejs
language.ejs
logs.ejs
path.ejs
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
__PSScriptPolicyTest_k0gpy4df.05c.ps1
BgImage.dll
StdUtils.dll
System.dll
splash.bmp
config.json
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
jna8612955446393167362.dll
data_2
data_3
es-ES-3-0.bdic
Network Persistent State
Network Persistent State
Network Persistent State~RFe58a37e.TMP
TransportSecurity
TransportSecurity
TransportSecurity~RFe57ea7f.TMP
CURRENT
MANIFEST-000001
13a846ed-9149-402e-821a-9ed0d52c8b13.tmp
the-real-index
the-real-index
the-real-index
the-real-index~RFe59faf0.TMP
index
data_0
data_1
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
default.dic
memory/752-15781-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15791-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15780-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15782-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15792-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15786-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15787-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15788-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15789-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/752-15790-0x0000025992B80000-0x0000025992B81000-memory.dmp
memory/1116-15070-0x0000028D59BC0000-0x0000028D59CC2000-memory.dmp
memory/1116-15068-0x0000028D598F0000-0x0000028D59912000-memory.dmp
memory/1116-15058-0x0000028D59920000-0x0000028D599A2000-memory.dmp
memory/1116-15069-0x0000028D58BE0000-0x0000028D58BF0000-memory.dmp
memory/3844-15872-0x00007FFBFB750000-0x00007FFBFB751000-memory.dmp
memory/3844-15871-0x00007FFBFBAC0000-0x00007FFBFBAC1000-memory.dmp
memory/5808-16398-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16401-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16390-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16391-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16400-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16399-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16397-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16396-0x00000264589B0000-0x00000264589B1000-memory.dmp
memory/5808-16392-0x00000264589B0000-0x00000264589B1000-memory.dmp