Analysis
- max time kernel
303s - max time network
309s - platform
windows10-2004_x64 - resource
win10v2004-20240802-es - resource tags
- submitted
18/08/2024, 11:41
General
- Target Battly-Launcher-Windows (1).exe
- Size 112.1MB
- Sample240818-nth87ascjf
- SHA256 9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://www.battlylauncher.com
Signatures
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 48 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 24 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 39 IoCs
- Suspicious use of SendNotifyMessage 42 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows (1).exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows (1).exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1656,i,5556895309280771505,17553279636902517206,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --mojo-platform-channel-handle=1876 --field-trial-handle=1656,i,5556895309280771505,17553279636902517206,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --app-path="C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2452 --field-trial-handle=1656,i,5556895309280771505,17553279636902517206,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://battlylauncher.com/claim?code=undefined4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98c1846f8,0x7ff98c184708,0x7ff98c1847185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10359145289801879503,886603299118589124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5136 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Battly Launcher\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\Battly Launcher\OperaSetup.exe" --silent --allusers=04⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exe --silent --allusers=0 --server-tracking-blob=OWNjYmFhNzMzZTQyYjNiNWQ2ZjRhNjBiOTgwODEwYmY3Y2VjNjVkMGZkYjkwODViNTUxZGU0YmMzYjcyM2I4Njp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWJhdHRseSZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1pbnN0YWxsZXIiLCJ0aW1lc3RhbXAiOiIxNzIzOTgxNDgyLjEzMTYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJpbnN0YWxsZXIiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImJhdHRseSJ9LCJ1dWlkIjoiNDVjYjNhYjQtODAwZC00OTM4LTlmMzgtZDc4ODhmZDkyNjlmIn0=5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.53 --initial-client-data=0x324,0x34c,0x350,0x348,0x354,0x738aa174,0x738aa180,0x738aa18c6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exe"C:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4812 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240818114440" --session-guid=a5b42965-aca9-46a9-b4cd-96f1d51c1f9d --server-tracking-blob="YWYyNWE1MTYwMTA0OThlNTJjN2MwOTQwNTQ2MWVlY2Y5ZjE1N2JhMWMyMTgyNDliYjcxODg5MGQ3YTljZWNiNjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWJhdHRseSZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1pbnN0YWxsZXIiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MjM5ODE0ODIuMTMxNiIsInV0bSI6eyJjYW1wYWlnbiI6Imluc3RhbGxlciIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiYmF0dGx5In0sInV1aWQiOiI0NWNiM2FiNC04MDBkLTQ5MzgtOWYzOC1kNzg4OGZkOTI2OWYifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=EC050000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS073F1F78\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.53 --initial-client-data=0x344,0x348,0x354,0x31c,0x358,0x7259a174,0x7259a180,0x7259a18c7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408181144401\assistant\Assistant_112.0.5197.30_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408181144401\assistant\Assistant_112.0.5197.30_Setup.exe_sfx.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408181144401\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408181144401\assistant\assistant_installer.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408181144401\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408181144401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.30 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x1098f40,0x1098f4c,0x1098f587⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exeC:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exe /A:C "/F:C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Battly Launcher.lnk" "/T:C:\Program Files\Battly Launcher\Battly Launcher.exe" "/I:C:\Program Files\Battly Launcher\resources\app\src\assets\images\icon.ico"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exeC:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\windows-shortcuts\lib\shortcut\Shortcut.exe /A:C "/F:C:\Users\Admin\Desktop\Battly Launcher.lnk" "/T:C:\Program Files\Battly Launcher\Battly Launcher.exe" "/I:C:\Program Files\Battly Launcher\resources\app\src\assets\images\icon.ico"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c " $battlyFolder = \"C:\Program Files/Battly Launcher\" $battlyPath = \"C:\Program Files/Battly Launcher\Battly Launcher.exe\" $programName = \"Battly Launcher\" $registryKey = \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$programName\" $developer = \"TECNO BROS\" $version = \"2.0.3\" $description = \"El mejor Launcher Personalizado para Minecraft Premium y No premium\" $uninstallCommand = \"$battlyFolder\uninstall.bat\" $website = \"https://www.battlylauncher.com\" $fileSize = (Get-Item $battlyPath).length / 1KB $registryProperties = @{ \"DisplayName\" = $programName \"DisplayIcon\" = $battlyPath \"UninstallString\" = $uninstallCommand \"Publisher\" = $developer \"DisplayVersion\" = $version \"Description\" = $description \"URLInfoAbout\" = $website \"EstimatedSize\" = $fileSize } New-Item -Path $registryKey -Force foreach ($property in $registryProperties.GetEnumerator()) { Set-ItemProperty -Path $registryKey -Name $property.Key -Value $property.Value } Write-Host \"Se ha añadido Battly a la lista de programas correctamente.\" "4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "NET SESSION"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET SESSION4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3248 --field-trial-handle=1656,i,5556895309280771505,17553279636902517206,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "NET SESSION"3⤵
-
C:\Windows\system32\net.exeNET SESSION4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 SESSION5⤵
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2416,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2708,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=3544,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3952,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3988,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3376,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4092,i,15987353935003739645,5448044164423271338,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=relauncher --no-sandbox --- "C:\Program Files\Battly Launcher\Battly Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1988,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=2292,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2756,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --field-trial-handle=3540,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3976,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4012,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Battly Launcher\Battly Launcher.exe"C:\Program Files\Battly Launcher\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BattlyLauncher" --app-user-model-id="Battly Launcher" --app-path="C:\Program Files\Battly Launcher\resources\app" --enable-sandbox --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2748,i,12140264497960627209,9637897068744405080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x49c1⤵
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
global_fetch.d.js
undici_symbols.d.js
LICENSE
LICENSE
index.js
index.js
LICENSE
license
LICENSE
.nycrc
ValidationMetadataArgs.js.map
ValidationSchema.js.map
ValidationArguments.js.map
ValidatorConstraintInterface.js.map
ValidatorOptions.js.map
ValidationOptions.js
ValidationOptions.js.map
decorators.js
decorators.js.map
index.js
index.js.map
ValidationMetadataArgs.js
convert-to-array.util.js
convert-to-array.util.js.map
get-global.util.js
get-global.util.js.map
index.js
index.js.map
is-promise.util.js
is-promise.util.js.map
ValidationSchema.js
ValidationArguments.js
ValidatorConstraintInterface.js
ValidatorOptions.js
libphonenumber-min.js
AsYouTypeFormatter.PatternParser.js.map
Leniency.test.js.map
utf-8.js.map
formatPhoneNumberForMobileDialing.test.js.map
extractNationalNumberFromPossiblyIncompleteNumber.js.map
metadata.max.json
metadata.max.json.d.cts
metadata.max.json.js
findNumbers.js
findPhoneNumbersInText.js
formatIncompletePhoneNumber.js
getCountries.js
getCountryCallingCode.js
getExampleNumber.js
getExtPrefix.js
isPossiblePhoneNumber.js
isSupportedCountry.js
isValidPhoneNumber.js
parsePhoneNumber.js
parsePhoneNumberWithError.js
searchNumbers.js
searchPhoneNumbersInText.js
validatePhoneNumberLength.js
index.d.cts
index.js
LICENSE.mkd
license
License
LICENSE
browser-entrypoint.js
has-cors.js
parseqs.js
parseuri.js
yeast.js
globalThis.browser.js
globalThis.js
index.js
package.json
index.js
websocket-constructor.browser.js
websocket-constructor.js
xmlhttprequest.browser.js
xmlhttprequest.js
util.js
LICENSE
LICENSE.BSD
estraverse.js
gulpfile.js
LICENSE
.nycrc
LICENSE
LICENSE
LICENSE
LICENSE
index.js
package.json
shams.js
tsconfig.json
LICENSE
LICENSE
Makefile
Makefile.targ
jsl.node.conf
extsprintf.js
package.json
CONTRIBUTING.md
instantiation.js
metadata_keys.js
metadata_keys.js.map
interfaces.js
interfaces.js.map
instantiation.js
clonable.js
clonable.js.map
factory_type.js
factory_type.js.map
id.js.map
.editorconfig
.eslintignore
LICENSE
index.js
package.json
shams.js
LICENSE
LICENSE
LICENSE
LICENSE.md
LICENSE
LICENSE
index.js.LICENSE.txt
package.json
LICENSE
LICENSE
comparator.js
index.js
semver.js
clean.js
cmp.js
coerce.js
compare-build.js
compare-loose.js
compare.js
diff.js
eq.js
gt.js
gte.js
inc.js
lt.js
lte.js
major.js
minor.js
neq.js
parse.js
patch.js
prerelease.js
rcompare.js
rsort.js
satisfies.js
sort.js
valid.js
index.js
constants.js
debug.js
identifiers.js
parse-options.js
re.js
preload.js
range.bnf
gtr.js
intersects.js
ltr.js
max-satisfying.js
min-satisfying.js
min-version.js
outside.js
simplify.js
subset.js
to-comparators.js
valid.js
auto.js
.editorconfig
LICENSE
tsconfig.json
CONTRIBUTING.md
GOVERNANCE.md
LICENSE
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
package.json
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
index.js
package.json
protobuf.js
LICENSE
punycode.js
License
browser.js
populate.js
LICENSE
LICENSE
browser-entrypoint.js
backo2.js
on.js
package.json
package.json
binary.js
is-binary.js
package.json
LICENSE
LICENSE
LICENSE
index.js
index.js
index.js
index.js
jsonfile.js
output-json-sync.js
output-json.js
index.js
make-dir.js
utils.js
index.js
LICENSE
index.js
package.json
utils.js
index.js
package.json
LICENSE
AUTHORS
uuid
index.js
nil.js
regex.js
validate.js
version.js
index.js
bytesToUuid.js
md5-browser.js
md5.js
rng-browser.js
rng.js
sha1-browser.js
sha1.js
v35.js
v1.js
v3.js
v4.js
v5.js
LICENSE
browser.js
index.js
buffer-util.js
event-target.js
extension.js
limiter.js
permessage-deflate.js
receiver.js
stream.js
subprotocol.js
websocket-server.js
wrapper.mjs
icon_transparent.png
LICENSE
cache.js
cookie.js
format-utils.js
formats.js
info-extras.js
sig.js
url-utils.js
Shelf.js
settings.dat
settings.dat
the-real-index
Network Persistent State
Preferences
Preferences
CURRENT
Local State
Local State
additional_file0.tmp
setup.exe
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
es.pak
resources.pak
CURRENT
LICENSE
adm-zip.js
package.json
index.js
package.json
inject.js
LICENSE.md
index.js
package.json
index.js
package.json
index.js
package.json
browser.js
index.js
package.json
package.json
index.js
templates.js
util.js
LICENSE
conversions.js
index.js
package.json
route.js
LICENSE
index.js
package.json
README.markdown
index.js
package.json
index.js
Mime.js
index.js
package.json
other.js
standard.js
package.json
LICENSE
ejs.js
utils.js
package.json
minimatch.js
package.json
package.json
ads.ejs
index.css
icon.ico
background.png
ar.png
de.png
en.png
es.png
fr.png
it.png
jp.png
pt.png
ru.png
opera_banner_es.png
index.js
es.js
main.js
eula.txt
eula.ejs
footer.ejs
header.ejs
index.ejs
index.js
install-options.ejs
language.ejs
logs.ejs
path.ejs
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
Opera_installer_2408181144401155860.dll
__PSScriptPolicyTest_hds5hahy.cmy.ps1
BgImage.dll
StdUtils.dll
System.dll
splash.bmp
config.json
data_2
index
data_0
data_1
data_3
es-ES-3-0.bdic
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State~RFe58fe31.TMP
TransportSecurity
TransportSecurity~RFe589843.TMP
1ebe88ec-64c3-43b7-ba0b-a3a81deda3c9.tmp
f_000003
f_000005
the-real-index
the-real-index
the-real-index
data_0
MANIFEST-000001
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
memory/2016-16871-0x0000023DF14C0000-0x0000023DF1542000-memory.dmp
memory/2016-16873-0x0000023DF1490000-0x0000023DF14B2000-memory.dmp
memory/2016-16882-0x0000023DF0E30000-0x0000023DF0E40000-memory.dmp
memory/2016-16883-0x0000023DF1960000-0x0000023DF1A62000-memory.dmp
memory/3784-923-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-920-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-918-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-914-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-913-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-912-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-924-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-919-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-922-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/3784-921-0x000001D3B4370000-0x000001D3B4371000-memory.dmp
memory/4520-17921-0x0000029D5CBA0000-0x0000029D5CC4D000-memory.dmp
memory/4520-17821-0x00007FF9AC320000-0x00007FF9AC321000-memory.dmp
memory/4520-17822-0x00007FF9AB180000-0x00007FF9AB181000-memory.dmp
memory/6272-18007-0x000001B677330000-0x000001B6773DD000-memory.dmp