hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/modern/Downloadly[.]zip

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/modern/Downloadly.zip

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	x2s443bc.cs1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	MassiveInstaller.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Downloadly.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	downloadly_installer.tmp

Executes dropped EXE 8 IoCs

pid	Process
1604	x2s443bc.cs1.tmp
2448	Downloadly.exe
4836	MassiveInstaller.exe
3248	MassiveInstaller.tmp
1576	Massive.exe
2000	crashpad_handler.exe
864	downloadly_installer.exe
1012	downloadly_installer.tmp

Loads dropped DLL 7 IoCs

pid	Process
2448	Downloadly.exe
2448	Downloadly.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Downloadly = "\"C:\\Users\\Admin\\Programs\\Downloadly\\Downloadly.exe\""	x2s443bc.cs1.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
57	raw.githubusercontent.com
58	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2216	taskkill.exe
4612	taskkill.exe
4116	taskkill.exe
3576	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
2056	msedge.exe
2056	msedge.exe
2120	identity_helper.exe
2120	identity_helper.exe
1952	msedge.exe
1952	msedge.exe
1604	x2s443bc.cs1.tmp
1604	x2s443bc.cs1.tmp
3248	MassiveInstaller.tmp
3248	MassiveInstaller.tmp
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
1576	Massive.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
1012	downloadly_installer.tmp
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	4612	taskkill.exe
Token: SeDebugPrivilege	4116	taskkill.exe
Token: SeDebugPrivilege	736	taskmgr.exe
Token: SeSystemProfilePrivilege	736	taskmgr.exe
Token: SeCreateGlobalPrivilege	736	taskmgr.exe
Token: SeDebugPrivilege	3576	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
1604	x2s443bc.cs1.tmp
2448	Downloadly.exe
3248	MassiveInstaller.tmp
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
1012	downloadly_installer.tmp
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2448	Downloadly.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe
736	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2448	Downloadly.exe
2448	Downloadly.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2696	2056	msedge.exe	84
PID 2056 wrote to memory of 2696	2056	msedge.exe	84
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 752	2056	msedge.exe	87
PID 2056 wrote to memory of 1844	2056	msedge.exe	88
PID 2056 wrote to memory of 1844	2056	msedge.exe	88
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89
PID 2056 wrote to memory of 1304	2056	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/modern/Downloadly.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a3e46f8,0x7ffe5a3e4708,0x7ffe5a3e4718
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,6416729969623623817,18349643213717496271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3576

C:\Users\Admin\Desktop\x2s443bc.cs1.exe
"C:\Users\Admin\Desktop\x2s443bc.cs1.exe"
1⤵
PID:4616
- C:\Users\Admin\AppData\Local\Temp\is-5M7C8.tmp\x2s443bc.cs1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5M7C8.tmp\x2s443bc.cs1.tmp" /SL5="$202A0,15784509,779776,C:\Users\Admin\Desktop\x2s443bc.cs1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1604
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Users\Admin\Programs\Downloadly\Downloadly.exe
    "C:\Users\Admin\Programs\Downloadly\Downloadly.exe" EnablePro
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe
      C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
      4⤵
      Executes dropped EXE
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\is-9A11L.tmp\MassiveInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9A11L.tmp\MassiveInstaller.tmp" /SL5="$402B2,10474064,1082880,C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3248
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Massive.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveUI.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
      - C:\Users\Admin\Programs\Massive\Massive.exe
        
        "C:\Users\Admin\Programs\Massive\Massive.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Massive\crashdumps --metrics-dir=C:\Users\Admin\AppData\Local\Massive\crashdumps --url=https://o428832.ingest.sentry.io:443/api/5375291/minidump/?sentry_client=sentry.native/0.4.9&sentry_key=5647f16acff64576af0bbfb18033c983 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\d1968e46-0902-4eb9-59cc-c72c745f7d1b.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\d1968e46-0902-4eb9-59cc-c72c745f7d1b.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\d1968e46-0902-4eb9-59cc-c72c745f7d1b.run\__sentry-breadcrumb2 --initial-client-data=0x3f4,0x3f8,0x3fc,0x3d0,0x404,0x7ff679b12fe0,0x7ff679b12fa0,0x7ff679b12fb0
        7⤵
        Executes dropped EXE
        
        PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Update-cb38bb98-b406-42d2-a5ea-878a3d11b694\downloadly_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Update-cb38bb98-b406-42d2-a5ea-878a3d11b694\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
      4⤵
      Executes dropped EXE
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\is-TKIF5.tmp\downloadly_installer.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TKIF5.tmp\downloadly_installer.tmp" /SL5="$103CE,15992205,779776,C:\Users\Admin\AppData\Local\Temp\Update-cb38bb98-b406-42d2-a5ea-878a3d11b694\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1012
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Massive\crashdumps\settings.dat

Filesize
40B

MD5
5c437ea51930ecc76300ba8def25fbe7

SHA1
cc0d555d9aefeb26e983b7207c475af40799ae09

SHA256
c2536cf418e3e3603d6878513e6f45876cfe8b8c8dffb1978b01fc9390f514c7

SHA512
a05e778740ac8652489b52e0ac43d4fe004db18b59bb75a5d3fcb9f29e0f85d4e90dafca90234784c8b4fc2ad060b04785b56b05cde146fe840a5d042d7fbbd2

Download Submit
C:\Users\Admin\AppData\Local\Massive\usage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Massive\usage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d87c539cbe95712f68341b722660a88c

SHA1
c789ba10f0f9ab8160bf723d179454df259be43e

SHA256
1fd04fb9a96c1b6a708f66a8492ada2557d907c86002a2f00336d02ffc438a3c

SHA512
0a5ac05d8372f749422607f3ec5659aab04dd575662de5a0c63fa419d2bc3731b421eb1c1abe96959f48d6f2ba7e037ab290aba4f1f2663f97919a1faded1582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
bf4a864406149396007cc0c283ba23cd

SHA1
197e495304ed09d135dc8ddc1b7d6e8968a24359

SHA256
4d21dbcc512ad4e65ee043877ff14a688662b38bfcc299c1be4348b13910f3dd

SHA512
09acde749d4862b68c4e3b3aba70d48a1cca4786e3676d3b6d4ab514c6837fd862f45a1a22bc66ead7d8e3a91eb717be63b3df5cb41b6e59bdef4e1009968bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0516806073e64d6c188f365d08061a78

SHA1
fbf91c37d8b425a1a1b8470d8a41f5632a2548ea

SHA256
a924257be87ce095a02aed7a59037c7cab56bf855fdf777399979fee5d36c8de

SHA512
0efdaa638007f8b0f05dfeb7faf1816246a2b9d07babe44a45deaa29350daecafc1c8457b19579eccb2b400b64f2c174a24589612b247de6a535662f51d17575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb2d544f83e0090e73944d2bf5dc0b80

SHA1
e85e275916043cdf31c488751087557d52ddf0ec

SHA256
f93b581822682035f905da91eb7ebccfdc687eff0ec7523fa08a831cd0a559bb

SHA512
03d78c275c59b7b68edf8c2f522ed3aee49e11e47f09ee41f4a3abbb054b727ca9d75d2c69813ea27f9a17a455fd26c704d82cf193bacf758174a0eb1ff52cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b02ae4196dd53c3e3c25d30ad352f31d

SHA1
4f81d64d25589ed39b79a6c9ffdc04607f990319

SHA256
e2bf27c671a4331ae59172204d012b38996b69da552451309b983e41edabcb2d

SHA512
0b031f3cc65b0e08b357d26bd4768e7be6b38b4960cf95c08f4f9974827244e2e1050e585fea73da3091d116b916b72d38532ff091a2c836ebe9b144f4604053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
238d307512a29cec1c76acd853822fc4

SHA1
55d360af26819002ea619e6b76909289c1d2389f

SHA256
170c51186fc6fceb143a94ec0c5cec8b62e69fe67be549eabfdeb12f73407f99

SHA512
1231791ee7a95b73cc4db460fb32f1ae049b79133545f9891447776b1b84187c4fb1d2f9cc4b7331be4dd5676faca8f214748e1695027264c2ad5ae66a596ea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4d070a5915e638214da434a45ff5057

SHA1
db10a2208a1414ac68f490a3b0fbd7606ca81b9a

SHA256
716d83476576621da0e1be20642b0d025603a99bac5b3beeca7588fe54f87b8a

SHA512
b42b47b24ee5923b07407281b5529cc5755d06bf48da880f951ec11e9ae53847aa401394bb3910a03929ea335421f24eb87032de0068e8694c1608cb6bc27153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8feb43183c1dc038b5060dfd6fcc9bfe

SHA1
0e8f1cb1a1f9b69933e7eb4dbd123579a7675f94

SHA256
7e12fedb807cbaabdb93436c6ebb54ee12d9db2efe6083e290417fd882479dc1

SHA512
8c5163359f026b69dd8d5d5c15adcae111dc9a776cf5efdf64ca42f98dc1c819106fefde185dde8399f73895a1e4fd8041872d4c72421c28b1839a12ffeafd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d39c.TMP

Filesize
864B

MD5
2167b0078f02185b00592a9d693b5553

SHA1
92ca1764a511b614ebd29fbef1f29be61dbb60ca

SHA256
4e2cd3cbd4a664fc2073b2d3864548785729fd4d9f9ccbfbca01c7f5bf328aa4

SHA512
9a04d196ca5d1e7a86dcc25989ee484844884141f7c3f349498e98ddbdbf39a2f23473a2180fd1f450f0d5304e3161afa9f56bd29fe6b5e5e84fdbce3141b8a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
383a1984c373de4567d19544185fdc08

SHA1
ff89a32857b6b8098add734df7adedf82687a20b

SHA256
27ff42d7e0a8cc2d55198b18b7b5e3c5da2e3ec8f8061a586a9b11cb0ffe18f2

SHA512
6e3d181d232124265a071e72a4c8a6aa53177b596f450a461dfdb7b5aaf92ee93d5f4ecf6971e77591f9b46952fe0779c05c2469976c2c2f923b830ceec1734e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01b4baaaf3db8ad2752c718a7559f39b

SHA1
d39a98a8bd144a2ff06a0f62b0a01e7febbbfcfd

SHA256
706b7cd27c0925d0be7e21edbba7efa03358d80120bdb3d6a6219ac8525b88e3

SHA512
eee149ddbdaa116c393b673695ae9ba8ad79c6905b51930f1e41fa5d41b511d3e39b5f7da67cbdd9232fa9d1d3695946116e6b56cb86866cadb0171e01842626

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update-cb38bb98-b406-42d2-a5ea-878a3d11b694\downloadly_installer.exe

Filesize
16.1MB

MD5
61016d79751db97b3908e31a438d89aa

SHA1
668c2f50db94be4d8f4f1b9a3719a1741f5bb802

SHA256
1b8a0d83673e2e5df870918d436ae62a7d65dae9351fbf59e3ca20902a5c33e0

SHA512
7e8b8bd34cda535052c57e6b5535e88546399d68be3ac1426c398d4a4fa63efdc9b5c32074478401dbe06e49f144bde2927fb9225b00f805427725c11519ad73

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5M7C8.tmp\x2s443bc.cs1.tmp

Filesize
3.0MB

MD5
0d5dc73779288fd019d9102766b0c7de

SHA1
d9f6ea89d4ba4119e92f892541719c8b5108f75f

SHA256
0a3d1d00bfdbded550d21df30275be9bca83fb74ca3b2aabd4b0886a5d7cc289

SHA512
b6b1cf77bcb9a2ad4faa08a33f54b16b09f956fa8a47e27587ad2b791a44dc0bd1b11704c3756104c6717abcaffc8dd9260e827eccd61551b79fcedd5210fe61

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9A11L.tmp\MassiveInstaller.tmp

Filesize
3.3MB

MD5
d8d247f50f2fcedb15d0c36f718d8485

SHA1
f8dc3506c4692f84045c8943de487ffdd4724778

SHA256
c7b839dce273e007b2a9739bc123584ca2c4ebc1fe3fe783ca004a38113ea221

SHA512
c9a31ad4de6e991353cdb4d2821134ae6dad4c420e3140ee455557844d84e651da089c56198b7b13b914d269f378b166e26dae2d8555d8f0cac0631c49c36ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TKIF5.tmp\downloadly_installer.tmp

Filesize
3.0MB

MD5
8097152e93a43ead7dc59cc88ea73017

SHA1
b21d9f73ecf57174ce8ec5091e60c3a653f97ecd

SHA256
5a522e16c4b9be7d757585c811e2b7b4eab6592aed1fbc807d4154974b7bb98f

SHA512
d885a2ecba46c324c05d63b5482d604429556fe864202b1127866f2798ead67228390fb730d44ccef205c8103129d89d88a9541a4657d55c01373f8db50f7b23

Download Submit
C:\Users\Admin\Downloads\Downloadly.zip

Filesize
15.4MB

MD5
fa4f62062e0cec23b5c1d8fe67f4be2f

SHA1
0735531f6e37a9807a1951d0d03b066b3949484b

SHA256
a88edca3b030046fe82e7add6da06311229c5c4f9396c30c04ab3f0b433eac6e

SHA512
0ffd333dc84ab8e4905fb76b3be69c7b9edba7f4eb72cc10efc82f6ae62d06c36227f4e8ada4f896e359e5ffc664d08caf76e15a40bd17e9384e73842e845995

Download Submit
C:\Users\Admin\Programs\Downloadly\Analytics.dll

Filesize
49KB

MD5
4bfda9b9b1176dc30c84a70fed2c1316

SHA1
72b1921cec6686f52d05a5d0cbed274cd01a0f00

SHA256
2d17ed0895df0d2f958573eb601a1485604e63d9f8ff905fc1fc74f1c43b2904

SHA512
178939745a74943c239db8c740a8f547649004df5c5b469d55967d69008803377bb47befc158b1d6faef421f0c5b583e975d55207c6f92a5b8769c2ae83ce9d1

Download Submit
C:\Users\Admin\Programs\Downloadly\AppIcon\icon.ico

Filesize
3KB

MD5
3387dda8a9109717168b2691a8c5bdd9

SHA1
ede213dc7dc627177aca420745a883b4cc1fde13

SHA256
99c2bab37ee04bc9dc210bef0365120ceb55f7d2f859eb1823c1a9d23ad75482

SHA512
581f0fe668584b5872cbc64e03296090ba323d83d250cee9aa65430cffb35c1dc367c04245f7f89643c752cfc3b8a681fa7a842355d52da1e98e1708c6749ff9

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe

Filesize
526KB

MD5
c64463e64b12c0362c622176c404b6af

SHA1
7002acb1bc1f23af70a473f1394d51e77b2835e4

SHA256
140dcfc3bde8405d26cfe50e08de2a084fb3be7cf33894463a182e12001f5ce7

SHA512
facd1c639196d36981c89048c4e9ccf5f4e2a57b37efc4404af6cafb3ec98954fe5695b0d3a3ee200b849d45d3718b52cce0af48efba7c23b1f4613bcaa35c0a

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe.config

Filesize
4KB

MD5
894f0bab00555ff07b8a97a05ef659fc

SHA1
e3a469e2654ab2630e13243b432abdbcd269836c

SHA256
6b56cc5c8bbc5cad7f55212643ed4a7408b43fa297642f250a05d3a59be21a8f

SHA512
697673191d1491652d0d42ca727b1be11cdf59ab11fe3330bdea8134de3ae32f4e83482c09e588b5b542ed869e1e5dc9e1094533b666d30f28b298f9046e8785

Download Submit
C:\Users\Admin\Programs\Downloadly\GalaSoft.MvvmLight.Platform.dll

Filesize
23KB

MD5
7151de121b4fe6857717320f96dbf93d

SHA1
f47502a8060a1d9f2a7e1e1ca5fbc8f04b614b29

SHA256
4be4fbb5e480f7dce0ecab4d0ef297ee9d761fd60bf1e4fe41a114b03d88f217

SHA512
ad61204640b7c46a5523452c722e1bc7cb775717cbe477739474382f323b261e515e94999e53cccfb84dd0d9131d0e24acc5260802dad46f8cb8c5832209920b

Download Submit
C:\Users\Admin\Programs\Downloadly\GalaSoft.MvvmLight.dll

Filesize
39KB

MD5
b0126ae2c9be757bda6e741924c4dea9

SHA1
814d3f73972ea86b2368c3c14d9ee804024f9e9e

SHA256
c13ad1d38fefb9d8aed071a82bd5bce2687ec1cabb819f30850088842e6dbe7b

SHA512
11bbbd2ee53cc6fe37beb6d3b849774d8f3e2053e756d9fedd7a2e29581aa959867f45c670f226c144a34a2a28a1369e227805b59fc9429d05e0b61a17ef64af

Download Submit
C:\Users\Admin\Programs\Downloadly\Massive.dll

Filesize
3.1MB

MD5
aa8a9be864bb1e25c6c371834beace33

SHA1
e3904292b2ca564258c9278d6cd5cc7dfc69f95e

SHA256
b384459db379a1f47877f38b5d0e6f615ee1811230ad5d1f456c800e63f0246d

SHA512
8ba1bcb21509276ac21146329c5b3508cd68fdaabf462d1579fd6e63992d72d74fbe095e0c242eec9d9f1e1c165b5d0be065b341b5e74c1ab84441cca7358806

Download Submit
C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe

Filesize
10.8MB

MD5
df851a46df574a7ddf3d79f20b3a8d70

SHA1
99ab5b3959ee37fcff5145f120c4d2f6c2c2c388

SHA256
02bdde9831c72990fad44ee43602215ec1a66f2cf25c8b012772be5af8142904

SHA512
3b67917c3473e8fcd7bd6a026315927f552a00ba170cb1e5a5f355fca2238ccef3e1baf019411bd0a9ab4090a085733e58ea56acec4fbf90b60c05b06ba0feb6

Download Submit
C:\Users\Admin\Programs\Downloadly\Microsoft.Win32.Primitives.dll

Filesize
16KB

MD5
7efc731f7158c8d98c699809d45ac809

SHA1
69d24f77a340d8319e6ace8270a1ffe006f8df98

SHA256
0ea953ff94624f4f187b6c77e3eaad667dafdb301c33050e62a39da21c01dd9f

SHA512
bbc77c57ad88278dc14a7cd1810f3ccc27e6dee9e5464161288c3e5bf574c8826562d2338043a0d401fe3bd19f25b71ced55d006a3a1008ed5b4ac2470eb376f

Download Submit
C:\Users\Admin\Programs\Downloadly\Newtonsoft.Json.dll

Filesize
686KB

MD5
785ee25cc12c75540fbcf20dbdd08140

SHA1
e94dac0a508e27a30a5472b2ebfa1016889a42f5

SHA256
d091c67e46698a82bf806eaf2d2c13c3da5d5aa858ba2ad1891fc7a5ddbb4de1

SHA512
a70cae48b3291b9abcfb003289c1567dbc2be9b542501c3bb70c58ec6c730d545b7aaff8f4c6e3a254225670c3b4ce91e0436515089173d020dd09ba6eef8873

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Common.dll

Filesize
98KB

MD5
f635fb8b55f6345104934f292645f77f

SHA1
6e597e93b6eb02aacc6e8f6e8d2911712fbedd42

SHA256
b2bdcec0726c348a6cfee98a6b1c34368b1ab79155fa6a2ab6e8a99d7a143148

SHA512
eb04ed4f6003a3cb73240e6fcf0b3fb4fd78b533b6ff49a7daba3e0d58cacbf75fbd0905a6788c7bd1b085532b2722abed9df857c7aefea0c9f64cde45d33e91

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Configuration.dll

Filesize
141KB

MD5
76b7e228bd295139651090d4a6ac671e

SHA1
51967f092c1fd08133f32015299aea92fb25694a

SHA256
464331a509819ed0d925c3b1f5327d552cc6152157356795dc561d98a6908767

SHA512
f047de07af7d1073d2c6de0b88ebf1713ba639703c8655672d02f624256b51bef386ec336b98a0608334d5df13a14ef713650bfb7da9f56fc44084a40ef089b2

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Frameworks.dll

Filesize
107KB

MD5
8be96240ff7e2ea372c3979e2267b0ac

SHA1
d67510ce34e82f73b41ddf571a05b8065988307e

SHA256
981282a0407aecc47a570a9d769928299eceadc774663088a22444686e5eb8db

SHA512
6f48bb0bb9322eaada75f97c0c5d0acec5959cb91a4caee5a054d85d83d633f35454e97d926d6380a6f6b258467ad7307144f7f21f7b4f76961b07dd2a69070d

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Versioning.dll

Filesize
49KB

MD5
329a6238da0953c00f3a5063c9466706

SHA1
fbca07e99271ab007e10847b48639ce72843b5a1

SHA256
82acbe9fc5f0853c1053f3a39750dafcbe1de5ad573b6807ab1304d1bf72ae92

SHA512
96209e10116b11cc05dbd2e9005af04b2535df48d8d7d34228b8a0244ba331695375f2613737eb95d29ca27876f24425c1e418d30b8fd10bef575fccceca05b1

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Diagnostics.Tracing.dll

Filesize
30KB

MD5
e38247be7a518b963c2cccddeb19b904

SHA1
0db8a1a9d1511560ddd1c901880d55f4cc3b5ad3

SHA256
840899ad1422364ec7285b954c11fda3f758ef11484ce46f84eb1db26c73bb31

SHA512
3e7ed362772741fdd096435ab745eb5ec6638596ce7e4d54a0022f63203448a6897c35ddd7afa9e450ae8f340603c9c2fd77e027f502bcda892df253ae1e4a52

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Globalization.Calendars.dll

Filesize
17KB

MD5
0defd78a96ba58998ea519567bebe8ee

SHA1
e5429013c492b7001e37bb7fb321dd2499021606

SHA256
c6f416a635fcbaa12b59b11bbcb02dd0feb635c91f0f727a93af997b2ebd8fda

SHA512
b764a2b38258c2908472b1a61b0e9aa19cb9b3cbdd160ee2866e052e118e6766fe8013c988cd15a6201723f51abdf07d79bfd4804e97d9827db91d3ac06e47d8

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Reflection.dll

Filesize
16KB

MD5
865b6c5db06807da35fbcb868b2b658c

SHA1
5ef84466ce329cb6ff1263f4def7b74e60c86477

SHA256
d934662fd9b48adbbb00c677273d2c276120487a5a1811e791365ed5f78a0535

SHA512
5165bc4a4b2417d7d2603c968f997edb3fa2cea2965aee4fb689148ede417bd7bf882cc6102e3632ddb94b12cceecfdfe90fa672baf067b03bbf04b591f00b50

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Runtime.InteropServices.dll

Filesize
19KB

MD5
88ced8603c157573f2caa7d546cba154

SHA1
079c6cc8ad485d14612e2685332e47637bc0162c

SHA256
2ca21604678973b95244f99f2d433f7662fb6b65ecf5d35ae5d3bb9a1e9a47a8

SHA512
e74d7d20dc939bb9d93586994de053de92cc2eeeb03603a1e6619389350584970d6d589f3873fd0fbef6abcafb34b5661601ad448dfe088b7480660b81508573

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Runtime.dll

Filesize
23KB

MD5
621a423e1d4baea253bc7102c2bab68a

SHA1
f23b95d48ac47376ac41c6bffb13763ceef3e657

SHA256
f05ceec233193b27335c4d45978c47ead955e6c7abdbe76b3b92ece44e0e3429

SHA512
fd2e445c00f32fb402bfb7b9b48604f8a8f23670135b84f8e96f1d17fa5ed5027d01b5a38998500f2cb1e047d82eae8475538aed298e9a2094e9487b44671cc6

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Security.Cryptography.Encoding.dll

Filesize
17KB

MD5
f80b936313b8778d2727f27addd09e22

SHA1
994f1d432a328be269592dd963db60c6685113ba

SHA256
09de71671aeaa9c5451d2e17950b94712003eeb00ded3beb213bd6eb98e41c57

SHA512
56f5b155dab8061b19193acf5f20ba60360013444b586c499f2bfdf7f125bd0c6e37c5bd79abd039ab9f533c27e355590638ae7629b62b2b968d1cfd55a2f327

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Windows.Interactivity.dll

Filesize
49KB

MD5
24bd7198db6aa878bdd58c62560db3eb

SHA1
e8b573ffa8a762d0797c0e49ee55281b76f81537

SHA256
adadee387560c99d464850a3b8ae95e6d21ca7c7661c2d5d6db9e2e33abe6463

SHA512
89992150fa84e6fc4ce4e9371cab48290c9f46fb09a5387873eb1d8dcb8ab4e0d13ccda0a1fca995189920a779347ef59f9f585354b618ac426dce2e8a5b1783

Download Submit
C:\Users\Admin\Programs\Downloadly\WinSparkle.dll

Filesize
2.0MB

MD5
598e7f89a37d006066a497440a8fbfd8

SHA1
067508e7621e8106a7d32587d2b17176172417ad

SHA256
f5f8540822f4c449364e0f71fdf85b33dfca50e73bdc0d59dd6de2cbde367bf3

SHA512
f8c2c73498f0e42ed7dadd8b8af257ead79e8404856bf0877cd71028564a9be9e9787fe40b54e5ffe00f863140fa987302a52399143d97b23bcc0df83b12626b

Download Submit
C:\Users\Admin\Programs\Downloadly\libvideo.dll

Filesize
60KB

MD5
0e2101e01d27dcdcb065676702eb7513

SHA1
af1b618fb32eeca3faeafbbfedf2e7a83f7cd50a

SHA256
f666932a8d2f66c01a32df6c7fcb16ef2274eac765b0d085db43d4264139fee1

SHA512
559c80204980729858fb1d7c327e2739f7bdc0bebe57d654e81ac37019963126d958c73b3532457f0ed1bf3ce5532f0f53d6a0187d4c038d485f1c4c32e6ce59

Download Submit
C:\Users\Admin\Programs\Downloadly\log4net.dll

Filesize
274KB

MD5
e4b95eee136c9c270f9b69b72162f300

SHA1
2b774fcfe5072b4c9ad61c9ebe7d0f26a57dc0ab

SHA256
02017ccacc6855755e8568f411ed248394606c004689119b59bb9ec8134caa39

SHA512
223e593a6bfa57353685ab4b5d77cced8c0dbf07ebdbd2b21077460f0a176428e8fea18eda98e65adc5e95844f089bbe5cc07362eda8cc1afdd9a4d5d95c3d46

Download Submit
C:\Users\Admin\Programs\Massive\Massive.exe

Filesize
3.7MB

MD5
42397eb43466f7659053d8bf97497d74

SHA1
a4fe1de9ea08b15bac7ea65b68d14ad3373877e0

SHA256
df6ad67d8d7bcd3129ca0b2377135e379e99380993838b26da0c92f3ce017109

SHA512
fd2c5ccfdcd2f8f7ad458a0f3180973d202bfd4f71578e1da56ccf9eee0fb12276d22e644f9a159db02eca838b4bab1bfe38cf6e7f2a583e5dbb142d72d59646

Download Submit
C:\Users\Admin\Programs\Massive\MiningGpu.dll

Filesize
606KB

MD5
e72cbbe8eee96adc4ccf8a8058d59d6d

SHA1
31236643077f556745d10727943ccc4aa44f3b73

SHA256
7613707891a06b00996f3988c37b6e8c771272bdefde2f29a95ce46637b16b76

SHA512
523e1e438c6f5e25804bdad08618c1b4b5c68aa146b5f9aa780a4c1e4acaff5a5ca9ee1d3661d25cd2a2ffa6089f8ecb9e935a676afff18831f858691f38b611

Download Submit
C:\Users\Admin\Programs\Massive\SysGpuInfoEx.dll

Filesize
92KB

MD5
b412db9083f140cf9054816edf27d258

SHA1
60338ec1b5f4cda1a6fcb851b4058a8dacc12dba

SHA256
2d6113737940a6562cecdc9bd0bd0d9a93be29486e1abbf7cbf82d5fed489be5

SHA512
e5357d7a0b547c7d5d68db9679b0fbdd47b331e048a716fb3be5ea916c91113324f2209db072a63fde7ea8b46d8e44a4a29bce15547d1a99446880c351ad1e36

Download Submit
C:\Users\Admin\Programs\Massive\WinSparkle.dll

Filesize
2.0MB

MD5
9d660209b1e0353f4e28c81929e90eef

SHA1
880db9173e6f6fcf90dc059df41c6576b7df5aa9

SHA256
e403f1550d010c03f7645cbb97a364370b4e831ab725945d75160edf7202e3ce

SHA512
7901c1369c7ec0ea05be995289dd61e5a35d2105a9b4475233fc8326dea7d5b1a68e3d4754887ea0859cf835a4b9b8477684e19942adfb184b33a0e42a511e1f

Download Submit
C:\Users\Admin\Programs\Massive\crashpad_handler.exe

Filesize
514KB

MD5
607a62e1edbee0ef95ca388cab43e5af

SHA1
44d9527140cee1eb32712bf05528546e54752488

SHA256
a9ecea7bc1de86a3fe66f96aa1c402794df4b1ea0170684cc9c08b12120f1ed4

SHA512
1a97f28eb29eb74fb58bddc8a5c242b85608ce70c99de3f4d2d1bf334de25bfc7a296de7f1f798ef87d48c6928720f0fcef7b43a7f9be6d04c007726e50bc090

Download Submit
C:\Users\Admin\Programs\Massive\nvml.dll

Filesize
985KB

MD5
d805b489c366b1a4e2b5cca7c05a1274

SHA1
92ab5416431924dc485649dc54e91bcee7867cb7

SHA256
2b06637175bf7816d3d8d046caef555bfa5b87cc2143403e516c2d8ee053e97b

SHA512
6875f0cbcf3097d43782a462c3933d94e6f6efed6cd207d770edd4c4f75f7bb3028ada9dbb73ddfbcb04a48c0957d5c6b0892014142b5621f91f37d7c0cb6ad1

Download Submit
C:\Users\Admin\Programs\Massive\xmrBridge.dll

Filesize
161KB

MD5
52b18788d85803093e262cc59f6b9ea1

SHA1
39ae3cf445e8c155c040c9f93080fe0952ef98d7

SHA256
c01b3d50d526a7999462152e7949c86fcf1720b3d558eb5bb9d0136e324230ec

SHA512
30b0b7ae7645c4c98403301e170eb80f2bb67325fc294abcd03bdd61b2fd0cec9ee716aae90d632e71503e926b74fe2b91773893d306eb5f5db0957d1dad04a7

Download Submit
memory/736-535-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-534-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-539-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-538-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-537-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-536-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-540-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-526-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-524-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/736-525-0x000001E6727E0000-0x000001E6727E1000-memory.dmp

Filesize
4KB

Download
memory/864-595-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/864-529-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1012-593-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/1604-402-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/2448-388-0x000001AB7A220000-0x000001AB7A242000-memory.dmp

Filesize
136KB

Download
memory/2448-393-0x000001AB7A1F0000-0x000001AB7A1FE000-memory.dmp

Filesize
56KB

Download
memory/2448-392-0x000001AB7B060000-0x000001AB7B098000-memory.dmp

Filesize
224KB

Download
memory/2448-391-0x000001AB79EA0000-0x000001AB79EA8000-memory.dmp

Filesize
32KB

Download
memory/2448-387-0x000001AB7B0D0000-0x000001AB7B180000-memory.dmp

Filesize
704KB

Download
memory/2448-382-0x000001AB613F0000-0x000001AB61400000-memory.dmp

Filesize
64KB

Download
memory/2448-380-0x000001AB61390000-0x000001AB613D6000-memory.dmp

Filesize
280KB

Download
memory/2448-378-0x000001AB5F770000-0x000001AB5F7F4000-memory.dmp

Filesize
528KB

Download
memory/3248-501-0x0000000000400000-0x000000000074F000-memory.dmp

Filesize
3.3MB

Download
memory/4616-406-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4616-221-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4836-407-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4836-502-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download