Analysis
- max time kernel
151s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
07/07/2024, 04:07
General
- Target Battly-Launcher-Windows.exe
- Size 183.1MB
- Sample240707-epycwatbql
- SHA256 a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://www.battlylauncher.com
Signatures
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 24 IoCs
- Loads dropped DLL 37 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 24 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 39 IoCs
- Suspicious use of SendNotifyMessage 41 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1692 --field-trial-handle=1696,i,9312486282851989996,16451241494789028112,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --mojo-platform-channel-handle=1880 --field-trial-handle=1696,i,9312486282851989996,16451241494789028112,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --app-path="C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2420 --field-trial-handle=1696,i,9312486282851989996,16451241494789028112,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://battlylauncher.com/claim?code=undefined4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7c0546f8,0x7ffc7c054708,0x7ffc7c0547185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,888425225813675821,2989457108685162183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://battlylauncher.com/claim?code=undefined4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc7c0546f8,0x7ffc7c054708,0x7ffc7c0547185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6664040469962901880,12864040760097362882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6664040469962901880,12864040760097362882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exeC:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exe /A:C "/F:C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Battly Launcher.lnk" "/T:C:\Program Files\Battly Launcher\Battly Launcher.exe" "/I:C:\Program Files\Battly Launcher\resources\app\src\assets\images\icon.ico"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exeC:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exe /A:C "/F:C:\Users\Admin\Desktop\Battly Launcher.lnk" "/T:C:\Program Files\Battly Launcher\Battly Launcher.exe" "/I:C:\Program Files\Battly Launcher\resources\app\src\assets\images\icon.ico"4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c " $battlyFolder = \"C:\Program Files/Battly Launcher\" $battlyPath = \"C:\Program Files/Battly Launcher\Battly Launcher.exe\" $programName = \"Battly Launcher\" $registryKey = \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$programName\" $developer = \"TECNO BROS\" $version = \"1.8.5\" $description = \"El mejor Launcher Personalizado para Minecraft Premium y No premium\" $uninstallCommand = \"$battlyFolder\uninstall.bat\" $website = \"https://www.battlylauncher.com\" $fileSize = (Get-Item $battlyPath).length / 1KB $registryProperties = @{ \"DisplayName\" = $programName \"DisplayIcon\" = $battlyPath \"UninstallString\" = $uninstallCommand \"Publisher\" = $developer \"DisplayVersion\" = $version \"Description\" = $description \"URLInfoAbout\" = $website \"EstimatedSize\" = $fileSize } New-Item -Path $registryKey -Force foreach ($property in $registryProperties.GetEnumerator()) { Set-ItemProperty -Path $registryKey -Name $property.Key -Value $property.Value } Write-Host \"Se ha añadido Battly a la lista de programas correctamente.\" "4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "NET SESSION"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET SESSION4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "NET SESSION"3⤵
-
C:\Windows\system32\net.exeNET SESSION4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION5⤵
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2372,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2684,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=3604,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4032,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4044,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2700,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4164,i,9062485857213139542,17380891866548265586,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=relauncher --no-sandbox --- "C:\Program Files\Battly Launcher\Battly Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2332,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2676,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=3560,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4040,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4056,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4184,i,13516596942417524026,6578606147549323458,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f4 0x4e81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE
license
LICENSE
.nycrc
ValidationMetadataArgs.js.map
ValidationSchema.js.map
ValidationArguments.js.map
ValidatorConstraintInterface.js.map
ValidatorOptions.js.map
ValidationOptions.js
ValidationOptions.js.map
decorators.js
decorators.js.map
index.js
index.js.map
ValidationMetadataArgs.js
convert-to-array.util.js
convert-to-array.util.js.map
get-global.util.js
get-global.util.js.map
index.js
index.js.map
is-promise.util.js
is-promise.util.js.map
ValidationSchema.js
ValidationArguments.js
ValidatorConstraintInterface.js
ValidatorOptions.js
LICENSE.mkd
License
LICENSE
browser-entrypoint.js
has-cors.js
parseqs.js
parseuri.js
yeast.js
globalThis.browser.js
globalThis.js
index.js
package.json
index.js
websocket-constructor.browser.js
websocket-constructor.js
xmlhttprequest.browser.js
xmlhttprequest.js
util.js
LICENSE
LICENSE.BSD
estraverse.js
gulpfile.js
LICENSE
LICENSE
.nycrc
LICENSE
LICENSE
tsconfig.json
LICENSE
instantiation.js
metadata_keys.js
metadata_keys.js.map
interfaces.js
interfaces.js.map
instantiation.js
clonable.js
clonable.js.map
factory_type.js
factory_type.js.map
id.js.map
.editorconfig
.eslintignore
LICENSE
LICENSE
LICENSE
tsconfig.json
LICENSE.md
index.js.LICENSE.txt
package.json
LICENSE
LICENSE
CONTRIBUTING.md
libphonenumber-min.js
AsYouTypeFormatter.PatternParser.js.map
Leniency.test.js.map
utf-8.js.map
formatPhoneNumberForMobileDialing.test.js.map
extractNationalNumberFromPossiblyIncompleteNumber.js.map
metadata.max.json
metadata.max.json.d.cts
metadata.max.json.js
findNumbers.js
findPhoneNumbersInText.js
formatIncompletePhoneNumber.js
getCountries.js
getCountryCallingCode.js
getExampleNumber.js
getExtPrefix.js
isPossiblePhoneNumber.js
isSupportedCountry.js
isValidPhoneNumber.js
parsePhoneNumber.js
parsePhoneNumberWithError.js
searchNumbers.js
searchPhoneNumbersInText.js
validatePhoneNumberLength.js
index.d.cts
index.js
LICENSE
LICENSE
license
semver.js
comparator.js
index.js
range.js
semver.js
clean.js
cmp.js
compare-build.js
compare-loose.js
compare.js
diff.js
eq.js
gt.js
gte.js
inc.js
lt.js
lte.js
major.js
minor.js
neq.js
parse.js
patch.js
prerelease.js
rcompare.js
rsort.js
satisfies.js
sort.js
valid.js
index.js
constants.js
debug.js
identifiers.js
parse-options.js
re.js
preload.js
range.bnf
gtr.js
intersects.js
ltr.js
max-satisfying.js
min-satisfying.js
min-version.js
outside.js
simplify.js
subset.js
to-comparators.js
valid.js
auto.js
.editorconfig
LICENSE
LICENSE
tsconfig.json
protobuf.js
punycode.js
License
browser.js
populate.js
LICENSE
browser-entrypoint.js
backo2.js
on.js
package.json
package.json
binary.js
is-binary.js
package.json
CONTRIBUTING.md
GOVERNANCE.md
LICENSE
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
package.json
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
index.js
package.json
LICENSE
string_decoder.js
package.json
LICENSE
index.js
nil.js
regex.js
validate.js
version.js
browser.js
index.js
constants.js
event-target.js
extension.js
limiter.js
stream.js
subprotocol.js
wrapper.mjs
icon_transparent.png
AZauth.js
Electron.js
NW.js
Terminal.js
Microsoft.js
Mojang.js
Index.js
index.js
fabric.js
forge.js
legacyFabric.js
neoForge.js
quilt.js
patcher.js
Minecraft-Arguments.js
Minecraft-Bundle.js
Minecraft-Loader.js
Minecraft-Lwjgl-Native.js
buffer.js
status.js
Downloader.js
Index.js
types.js
settings.dat
settings.dat
f_000001
the-real-index
Network Persistent State
Preferences
Preferences
CURRENT
Local State
Local State
data_1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libglesv2.dll
en-US.pak
resources.pak
LICENSE
adm-zip.js
package.json
index.js
package.json
inject.js
LICENSE.md
index.js
package.json
index.js
package.json
index.js
package.json
browser.js
index.js
package.json
package.json
index.js
templates.js
util.js
LICENSE
conversions.js
index.js
package.json
route.js
LICENSE
index.js
package.json
README.markdown
index.js
package.json
index.js
Mime.js
index.js
package.json
other.js
standard.js
package.json
LICENSE
ejs.js
utils.js
package.json
minimatch.js
package.json
package.json
ads.ejs
index.css
icon.ico
background.png
ar.png
de.png
en.png
es.png
fr.png
it.png
jp.png
pt.png
ru.png
opera_banner_es.png
index-es.js
index.js
es.js
eula.txt
eula.ejs
footer.ejs
header.ejs
index.ejs
index.js
install-options.ejs
language.ejs
logs.ejs
path.ejs
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
__PSScriptPolicyTest_acpsdayb.omw.ps1
BgImage.dll
StdUtils.dll
System.dll
splash.bmp
config.json
data_0
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State~RFe58b968.TMP
TransportSecurity
TransportSecurity
TransportSecurity~RFe58b522.TMP
CURRENT
MANIFEST-000001
534d2942-1ec5-4475-8db7-83e40455e8a5.tmp
f_000002
f_000003
index
the-real-index
the-real-index
Network Persistent State
default.dic
memory/3788-16153-0x00007FFC8A420000-0x00007FFC8A421000-memory.dmp
memory/3788-16154-0x00007FFC893D0000-0x00007FFC893D1000-memory.dmp
memory/3788-16288-0x0000020A21C60000-0x0000020A21D0D000-memory.dmp
memory/3788-16287-0x0000020A222A0000-0x0000020A229DF000-memory.dmp
memory/5016-15348-0x0000021E77730000-0x0000021E77752000-memory.dmp