hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit[.]zip

Resubmissions

04-08-2024 09:02

240804-kzf48s1glm 8

04-08-2024 08:57

240804-kw28aswbpc 10

03-08-2024 19:52

240803-ylf4zatcrq 3

Analysis

max time kernel
113s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	downloadly_installer.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	MassiveInstaller.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	x2s443bc.cs1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	MassiveInstaller.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	Downloadly.exe

Executes dropped EXE 11 IoCs

pid	Process
720	x2s443bc.cs1.tmp
4256	Downloadly.exe
840	MassiveInstaller.exe
880	MassiveInstaller.tmp
4892	Massive.exe
1728	crashpad_handler.exe
3712	downloadly_installer.exe
3032	downloadly_installer.tmp
4064	Downloadly.exe
1376	MassiveInstaller.exe
3960	MassiveInstaller.tmp

Loads dropped DLL 9 IoCs

pid	Process
4256	Downloadly.exe
4256	Downloadly.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4064	Downloadly.exe
4064	Downloadly.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Downloadly = "\"C:\\Users\\Admin\\Programs\\Downloadly\\Downloadly.exe\""	x2s443bc.cs1.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Downloadly = "\"C:\\Users\\Admin\\Programs\\Downloadly\\Downloadly.exe\""	downloadly_installer.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
48	camo.githubusercontent.com
49	camo.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2s443bc.cs1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2s443bc.cs1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
2928	taskkill.exe
3028	taskkill.exe
1644	taskkill.exe
3980	taskkill.exe
4616	taskkill.exe
3184	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
1560	msedge.exe
1560	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe
2024	msedge.exe
2024	msedge.exe
720	x2s443bc.cs1.tmp
720	x2s443bc.cs1.tmp
880	MassiveInstaller.tmp
880	MassiveInstaller.tmp
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
4892	Massive.exe
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3032	downloadly_installer.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp
3960	MassiveInstaller.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	4064	Downloadly.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
720	x2s443bc.cs1.tmp
4256	Downloadly.exe
880	MassiveInstaller.tmp
3032	downloadly_installer.tmp
4064	Downloadly.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
4256	Downloadly.exe
4064	Downloadly.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4256	Downloadly.exe
4256	Downloadly.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3776	1560	msedge.exe	84
PID 1560 wrote to memory of 3776	1560	msedge.exe	84
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2516	1560	msedge.exe	86
PID 1560 wrote to memory of 2436	1560	msedge.exe	87
PID 1560 wrote to memory of 2436	1560	msedge.exe	87
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88
PID 1560 wrote to memory of 1252	1560	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1fcd46f8,0x7ffd1fcd4708,0x7ffd1fcd4718
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11068931944808544991,200080586953633631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1972

C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly.zip\x2s443bc.cs1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly.zip\x2s443bc.cs1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2172
- C:\Users\Admin\AppData\Local\Temp\is-FEUEB.tmp\x2s443bc.cs1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FEUEB.tmp\x2s443bc.cs1.tmp" /SL5="$802B4,15784509,779776,C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly.zip\x2s443bc.cs1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:720
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- - C:\Users\Admin\Programs\Downloadly\Downloadly.exe
    "C:\Users\Admin\Programs\Downloadly\Downloadly.exe" EnablePro
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4256
  - - C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe
      C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\is-1Q8N3.tmp\MassiveInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1Q8N3.tmp\MassiveInstaller.tmp" /SL5="$602A0,10474064,1082880,C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:880
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Massive.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveUI.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
      - C:\Users\Admin\Programs\Massive\Massive.exe
        
        "C:\Users\Admin\Programs\Massive\Massive.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4892
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Massive\crashdumps --metrics-dir=C:\Users\Admin\AppData\Local\Massive\crashdumps --url=https://o428832.ingest.sentry.io:443/api/5375291/minidump/?sentry_client=sentry.native/0.4.9&sentry_key=5647f16acff64576af0bbfb18033c983 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\68f4e5c0-eac7-432b-6c2a-b969a81c731d.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\68f4e5c0-eac7-432b-6c2a-b969a81c731d.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\68f4e5c0-eac7-432b-6c2a-b969a81c731d.run\__sentry-breadcrumb2 --initial-client-data=0x3f4,0x3f8,0x3fc,0x3d0,0x404,0x7ff63e582fe0,0x7ff63e582fa0,0x7ff63e582fb0
        7⤵
        Executes dropped EXE
        
        PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Update-ba3057c4-b800-4e7d-873c-180a5648fcfe\downloadly_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Update-ba3057c4-b800-4e7d-873c-180a5648fcfe\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\is-DSPEA.tmp\downloadly_installer.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DSPEA.tmp\downloadly_installer.tmp" /SL5="$802A0,15992205,779776,C:\Users\Admin\AppData\Local\Temp\Update-ba3057c4-b800-4e7d-873c-180a5648fcfe\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3032
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
      - C:\Users\Admin\Programs\Downloadly\Downloadly.exe
        
        "C:\Users\Admin\Programs\Downloadly\Downloadly.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4064
        
        C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe
        
        C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\is-48FPC.tmp\MassiveInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-48FPC.tmp\MassiveInstaller.tmp" /SL5="$502FC,10516965,1082880,C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Massive.exe
        9⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveUI.exe
        9⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Massive\crashdumps\settings.dat

Filesize
40B

MD5
723ea6c9fa7a59911f4adf10f9d0a19e

SHA1
fa96b86e54a7762b0fe334cf6711ed02835e0538

SHA256
67ecf81b45bae21b210d3ee275d63a1e6126638775d9b7a3b932720befa13e8a

SHA512
3cd6a75bbf2d2f7b67208a20811f09758d4a02c906781c7916cde684a106b495211948a0a95297052d0c1e0af2557a36cf272aa4f5b14a494339955bf6ca35ac

Download Submit
C:\Users\Admin\AppData\Local\Massive\usage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Massive\usage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ab7c2df-c340-4d16-90b9-c241b7ab1469.tmp

Filesize
663B

MD5
87520d541bc34fadb4724d1566006526

SHA1
8c289a21c696ba6ea7c9f703fed8f2e71798f202

SHA256
61b5fbf8ebe0544712b6a8ed189c6431a670dc90b6d35e421eb6b8b71bbccaaf

SHA512
8ff0cc66001e1a6316228efc0ce2e416e23ec52d19f77230a5429aa8e87656e7eb864f647829db738e66e61d777d04ed2af70cf4d5dc1994a74f53286f93817a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
68e8774881b5cd0be83b1aa8bcb2af7c

SHA1
c4f972ec51b9c0f5ec7ab0c79f1267910e9a684b

SHA256
0998828a81b258fef6f35fc9d39cc6aad38403e4cae96c844e9f6b9a132b72cc

SHA512
fd27f897eabb779feb1e51cb3ea29509742db20b41d1f83a741f2beaba9a35086648ae5d0548e320ec0409bba3f00134ed8ffd076a0467fcb96185b1d9c485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccc27bde2b3ace53beee0cdddf3df23c

SHA1
a00a33c51baf66837a748eccb092ca78300feb10

SHA256
93312452b6791dff8f01ae1cd51241d8ce297ef6fefbb9793a4135770aa93ca9

SHA512
f16142217d5556a8c37cfe0c3589ffd2d1eea4145f6dc3dd2b4a5f8f44a246de37a2abcd3ad7693e6b62b92375b07408d5a432b317c33142826a321e25c87c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
968180b9e2b4781593a7619cda20e35a

SHA1
b262fbd38ec9185878dd4efd53d2d3bc15b4af84

SHA256
58be7a820ef878e171ec21d4db14c8fbf59d7445aa566399988aa568206e16cb

SHA512
8e21b1b8c09ba0282d6946dbd969f004714d062d5df17853534f96a8f3c52e2d9c1f3aa34590aa4e646cbe6ce4dc1254bc69b248ecb1a8d9cd19f96e56dbe107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
505c681371ad197509b24203acad0a70

SHA1
d74245b249b513c6ca7433ee9e2933286b8aacfd

SHA256
a1603c1cd393c30c6e92e09325d97b56a6315822fc8e2dd79b3058d40fa6a7eb

SHA512
69b3af3d2cff1fd64a1e0f4fdeb7baa3fb94903084916b662e577687330f3c71fd8dd4a4765c9d3534fae2ecfd8715358337857c965dc0d5a4003775f64ee60a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a79d359b0966614df14187e677bd082

SHA1
1a7591f73a8552661f667c521044af9dac912334

SHA256
92ae6de7938e5fe6917e740f59c91547f934c3b48ee26640e492c3207d8108d4

SHA512
94b4e509743515190ebbc5921d17680d731d4af90e0510242c519e8f40ab4098a87b665ae350d54bc0eacea1d16fff700c54d95f7e270f0bbf91cdb587576636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d59f.TMP

Filesize
1KB

MD5
af0e807bdcff90f668f118083ddd692b

SHA1
5fe3b91dfa46c7ad27655772d029a6cf2e4e1809

SHA256
0e63c61438a8ee143f39d7c2d463cdc72e2109690fc66c0346c38c9642b80816

SHA512
28cdac6beb8ed292679cd61e2d246b44bf11f88068ec9ec5a11f5e2d969e237aab6120df4fbde5a4c3aeefa096525d3bd6c10d7f316b15655afe72ae1dbd5cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65f9d75189ab2d6dca00419594ebba7e

SHA1
bf97afa91d91d3e04c8c135a635e6d4df7fe4ee7

SHA256
3cf0def404b3aed61ed904d750b2d73ee4e95a32173a363b91ea3cf1795c0170

SHA512
140b648f61ffa41d3052dc7cd671cffa8352c5d2b9324cb39ec73bfa5ee6f0c5d181ed3651d3adf5049893c1155185caa891d3a0ea2992d6d6d015b194472cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd4f710453fa6d4318ed1fc37c6a2b38

SHA1
618643476e1c1f57bd308ce62b1eab8e3ad84334

SHA256
39526b991b257e4f5d749c052b4b1b872dde87b9b63ede340817df8aa670804b

SHA512
45321b42f3767e24e213e1e876f97ee870cff064e96da264e79d6d13024762d0d94d051d4741d1ca0fc8c5a99a5eaa3ebfc8d36c36b2fbc3275ea88814708934

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update-ba3057c4-b800-4e7d-873c-180a5648fcfe\downloadly_installer.exe

Filesize
16.1MB

MD5
61016d79751db97b3908e31a438d89aa

SHA1
668c2f50db94be4d8f4f1b9a3719a1741f5bb802

SHA256
1b8a0d83673e2e5df870918d436ae62a7d65dae9351fbf59e3ca20902a5c33e0

SHA512
7e8b8bd34cda535052c57e6b5535e88546399d68be3ac1426c398d4a4fa63efdc9b5c32074478401dbe06e49f144bde2927fb9225b00f805427725c11519ad73

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1Q8N3.tmp\MassiveInstaller.tmp

Filesize
3.3MB

MD5
d8d247f50f2fcedb15d0c36f718d8485

SHA1
f8dc3506c4692f84045c8943de487ffdd4724778

SHA256
c7b839dce273e007b2a9739bc123584ca2c4ebc1fe3fe783ca004a38113ea221

SHA512
c9a31ad4de6e991353cdb4d2821134ae6dad4c420e3140ee455557844d84e651da089c56198b7b13b914d269f378b166e26dae2d8555d8f0cac0631c49c36ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DSPEA.tmp\downloadly_installer.tmp

Filesize
3.0MB

MD5
8097152e93a43ead7dc59cc88ea73017

SHA1
b21d9f73ecf57174ce8ec5091e60c3a653f97ecd

SHA256
5a522e16c4b9be7d757585c811e2b7b4eab6592aed1fbc807d4154974b7bb98f

SHA512
d885a2ecba46c324c05d63b5482d604429556fe864202b1127866f2798ead67228390fb730d44ccef205c8103129d89d88a9541a4657d55c01373f8db50f7b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FEUEB.tmp\x2s443bc.cs1.tmp

Filesize
3.0MB

MD5
0d5dc73779288fd019d9102766b0c7de

SHA1
d9f6ea89d4ba4119e92f892541719c8b5108f75f

SHA256
0a3d1d00bfdbded550d21df30275be9bca83fb74ca3b2aabd4b0886a5d7cc289

SHA512
b6b1cf77bcb9a2ad4faa08a33f54b16b09f956fa8a47e27587ad2b791a44dc0bd1b11704c3756104c6717abcaffc8dd9260e827eccd61551b79fcedd5210fe61

Download Submit
C:\Users\Admin\Downloads\Downloadly.zip

Filesize
15.4MB

MD5
fa4f62062e0cec23b5c1d8fe67f4be2f

SHA1
0735531f6e37a9807a1951d0d03b066b3949484b

SHA256
a88edca3b030046fe82e7add6da06311229c5c4f9396c30c04ab3f0b433eac6e

SHA512
0ffd333dc84ab8e4905fb76b3be69c7b9edba7f4eb72cc10efc82f6ae62d06c36227f4e8ada4f896e359e5ffc664d08caf76e15a40bd17e9384e73842e845995

Download Submit
C:\Users\Admin\Programs\Downloadly\Analytics.dll

Filesize
49KB

MD5
4bfda9b9b1176dc30c84a70fed2c1316

SHA1
72b1921cec6686f52d05a5d0cbed274cd01a0f00

SHA256
2d17ed0895df0d2f958573eb601a1485604e63d9f8ff905fc1fc74f1c43b2904

SHA512
178939745a74943c239db8c740a8f547649004df5c5b469d55967d69008803377bb47befc158b1d6faef421f0c5b583e975d55207c6f92a5b8769c2ae83ce9d1

Download Submit
C:\Users\Admin\Programs\Downloadly\AppIcon\icon.ico

Filesize
3KB

MD5
3387dda8a9109717168b2691a8c5bdd9

SHA1
ede213dc7dc627177aca420745a883b4cc1fde13

SHA256
99c2bab37ee04bc9dc210bef0365120ceb55f7d2f859eb1823c1a9d23ad75482

SHA512
581f0fe668584b5872cbc64e03296090ba323d83d250cee9aa65430cffb35c1dc367c04245f7f89643c752cfc3b8a681fa7a842355d52da1e98e1708c6749ff9

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe

Filesize
526KB

MD5
c64463e64b12c0362c622176c404b6af

SHA1
7002acb1bc1f23af70a473f1394d51e77b2835e4

SHA256
140dcfc3bde8405d26cfe50e08de2a084fb3be7cf33894463a182e12001f5ce7

SHA512
facd1c639196d36981c89048c4e9ccf5f4e2a57b37efc4404af6cafb3ec98954fe5695b0d3a3ee200b849d45d3718b52cce0af48efba7c23b1f4613bcaa35c0a

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe

Filesize
536KB

MD5
9e1e1786225710dc73f330cc7f711603

SHA1
b9214d56f15254ca24706d71c1e003440067fd8c

SHA256
bd19ac814c4ff0e67a9e40e35df8abd7f12ffaa6ebefaa83344d553d7f007166

SHA512
6398a6a14c57210dc61ed1b79ead4898df2eb9cea00e431c39fc4fb9a5442c2dc83272a22ca1d0c7819c9b3a12316f08e09e93c2594d51d7e7e257f587a04bef

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe.config

Filesize
4KB

MD5
894f0bab00555ff07b8a97a05ef659fc

SHA1
e3a469e2654ab2630e13243b432abdbcd269836c

SHA256
6b56cc5c8bbc5cad7f55212643ed4a7408b43fa297642f250a05d3a59be21a8f

SHA512
697673191d1491652d0d42ca727b1be11cdf59ab11fe3330bdea8134de3ae32f4e83482c09e588b5b542ed869e1e5dc9e1094533b666d30f28b298f9046e8785

Download Submit
C:\Users\Admin\Programs\Downloadly\GalaSoft.MvvmLight.Platform.dll

Filesize
23KB

MD5
7151de121b4fe6857717320f96dbf93d

SHA1
f47502a8060a1d9f2a7e1e1ca5fbc8f04b614b29

SHA256
4be4fbb5e480f7dce0ecab4d0ef297ee9d761fd60bf1e4fe41a114b03d88f217

SHA512
ad61204640b7c46a5523452c722e1bc7cb775717cbe477739474382f323b261e515e94999e53cccfb84dd0d9131d0e24acc5260802dad46f8cb8c5832209920b

Download Submit
C:\Users\Admin\Programs\Downloadly\GalaSoft.MvvmLight.dll

Filesize
39KB

MD5
b0126ae2c9be757bda6e741924c4dea9

SHA1
814d3f73972ea86b2368c3c14d9ee804024f9e9e

SHA256
c13ad1d38fefb9d8aed071a82bd5bce2687ec1cabb819f30850088842e6dbe7b

SHA512
11bbbd2ee53cc6fe37beb6d3b849774d8f3e2053e756d9fedd7a2e29581aa959867f45c670f226c144a34a2a28a1369e227805b59fc9429d05e0b61a17ef64af

Download Submit
C:\Users\Admin\Programs\Downloadly\Massive.dll

Filesize
3.1MB

MD5
aa8a9be864bb1e25c6c371834beace33

SHA1
e3904292b2ca564258c9278d6cd5cc7dfc69f95e

SHA256
b384459db379a1f47877f38b5d0e6f615ee1811230ad5d1f456c800e63f0246d

SHA512
8ba1bcb21509276ac21146329c5b3508cd68fdaabf462d1579fd6e63992d72d74fbe095e0c242eec9d9f1e1c165b5d0be065b341b5e74c1ab84441cca7358806

Download Submit
C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe

Filesize
10.8MB

MD5
df851a46df574a7ddf3d79f20b3a8d70

SHA1
99ab5b3959ee37fcff5145f120c4d2f6c2c2c388

SHA256
02bdde9831c72990fad44ee43602215ec1a66f2cf25c8b012772be5af8142904

SHA512
3b67917c3473e8fcd7bd6a026315927f552a00ba170cb1e5a5f355fca2238ccef3e1baf019411bd0a9ab4090a085733e58ea56acec4fbf90b60c05b06ba0feb6

Download Submit
C:\Users\Admin\Programs\Downloadly\Microsoft.Win32.Primitives.dll

Filesize
16KB

MD5
7efc731f7158c8d98c699809d45ac809

SHA1
69d24f77a340d8319e6ace8270a1ffe006f8df98

SHA256
0ea953ff94624f4f187b6c77e3eaad667dafdb301c33050e62a39da21c01dd9f

SHA512
bbc77c57ad88278dc14a7cd1810f3ccc27e6dee9e5464161288c3e5bf574c8826562d2338043a0d401fe3bd19f25b71ced55d006a3a1008ed5b4ac2470eb376f

Download Submit
C:\Users\Admin\Programs\Downloadly\Newtonsoft.Json.dll

Filesize
686KB

MD5
785ee25cc12c75540fbcf20dbdd08140

SHA1
e94dac0a508e27a30a5472b2ebfa1016889a42f5

SHA256
d091c67e46698a82bf806eaf2d2c13c3da5d5aa858ba2ad1891fc7a5ddbb4de1

SHA512
a70cae48b3291b9abcfb003289c1567dbc2be9b542501c3bb70c58ec6c730d545b7aaff8f4c6e3a254225670c3b4ce91e0436515089173d020dd09ba6eef8873

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Common.dll

Filesize
98KB

MD5
f635fb8b55f6345104934f292645f77f

SHA1
6e597e93b6eb02aacc6e8f6e8d2911712fbedd42

SHA256
b2bdcec0726c348a6cfee98a6b1c34368b1ab79155fa6a2ab6e8a99d7a143148

SHA512
eb04ed4f6003a3cb73240e6fcf0b3fb4fd78b533b6ff49a7daba3e0d58cacbf75fbd0905a6788c7bd1b085532b2722abed9df857c7aefea0c9f64cde45d33e91

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Configuration.dll

Filesize
141KB

MD5
76b7e228bd295139651090d4a6ac671e

SHA1
51967f092c1fd08133f32015299aea92fb25694a

SHA256
464331a509819ed0d925c3b1f5327d552cc6152157356795dc561d98a6908767

SHA512
f047de07af7d1073d2c6de0b88ebf1713ba639703c8655672d02f624256b51bef386ec336b98a0608334d5df13a14ef713650bfb7da9f56fc44084a40ef089b2

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Frameworks.dll

Filesize
107KB

MD5
8be96240ff7e2ea372c3979e2267b0ac

SHA1
d67510ce34e82f73b41ddf571a05b8065988307e

SHA256
981282a0407aecc47a570a9d769928299eceadc774663088a22444686e5eb8db

SHA512
6f48bb0bb9322eaada75f97c0c5d0acec5959cb91a4caee5a054d85d83d633f35454e97d926d6380a6f6b258467ad7307144f7f21f7b4f76961b07dd2a69070d

Download Submit
C:\Users\Admin\Programs\Downloadly\NuGet.Versioning.dll

Filesize
49KB

MD5
329a6238da0953c00f3a5063c9466706

SHA1
fbca07e99271ab007e10847b48639ce72843b5a1

SHA256
82acbe9fc5f0853c1053f3a39750dafcbe1de5ad573b6807ab1304d1bf72ae92

SHA512
96209e10116b11cc05dbd2e9005af04b2535df48d8d7d34228b8a0244ba331695375f2613737eb95d29ca27876f24425c1e418d30b8fd10bef575fccceca05b1

Download Submit
C:\Users\Admin\Programs\Downloadly\PresentationCore.dll

Filesize
1.2MB

MD5
29cc2e7cea3f5d049a2cb2667583d888

SHA1
53d50f8318d399a1577779f7b4fd2ea462db0b65

SHA256
a9ddc4ac5acc992f5e003e68c9e58efba484a514439f322eb2cb0c85eec44d68

SHA512
bef4e19336324821d2773776a81050cd5b069d4dbb077151d187de6f860df20125a10ec34f2fabcec67c0fd1dee98431ab53581aaf4f707eaedf4b008a15bd91

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Diagnostics.Tracing.dll

Filesize
30KB

MD5
e38247be7a518b963c2cccddeb19b904

SHA1
0db8a1a9d1511560ddd1c901880d55f4cc3b5ad3

SHA256
840899ad1422364ec7285b954c11fda3f758ef11484ce46f84eb1db26c73bb31

SHA512
3e7ed362772741fdd096435ab745eb5ec6638596ce7e4d54a0022f63203448a6897c35ddd7afa9e450ae8f340603c9c2fd77e027f502bcda892df253ae1e4a52

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Globalization.Calendars.dll

Filesize
17KB

MD5
0defd78a96ba58998ea519567bebe8ee

SHA1
e5429013c492b7001e37bb7fb321dd2499021606

SHA256
c6f416a635fcbaa12b59b11bbcb02dd0feb635c91f0f727a93af997b2ebd8fda

SHA512
b764a2b38258c2908472b1a61b0e9aa19cb9b3cbdd160ee2866e052e118e6766fe8013c988cd15a6201723f51abdf07d79bfd4804e97d9827db91d3ac06e47d8

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Reflection.dll

Filesize
16KB

MD5
865b6c5db06807da35fbcb868b2b658c

SHA1
5ef84466ce329cb6ff1263f4def7b74e60c86477

SHA256
d934662fd9b48adbbb00c677273d2c276120487a5a1811e791365ed5f78a0535

SHA512
5165bc4a4b2417d7d2603c968f997edb3fa2cea2965aee4fb689148ede417bd7bf882cc6102e3632ddb94b12cceecfdfe90fa672baf067b03bbf04b591f00b50

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Runtime.InteropServices.dll

Filesize
19KB

MD5
88ced8603c157573f2caa7d546cba154

SHA1
079c6cc8ad485d14612e2685332e47637bc0162c

SHA256
2ca21604678973b95244f99f2d433f7662fb6b65ecf5d35ae5d3bb9a1e9a47a8

SHA512
e74d7d20dc939bb9d93586994de053de92cc2eeeb03603a1e6619389350584970d6d589f3873fd0fbef6abcafb34b5661601ad448dfe088b7480660b81508573

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Runtime.dll

Filesize
23KB

MD5
621a423e1d4baea253bc7102c2bab68a

SHA1
f23b95d48ac47376ac41c6bffb13763ceef3e657

SHA256
f05ceec233193b27335c4d45978c47ead955e6c7abdbe76b3b92ece44e0e3429

SHA512
fd2e445c00f32fb402bfb7b9b48604f8a8f23670135b84f8e96f1d17fa5ed5027d01b5a38998500f2cb1e047d82eae8475538aed298e9a2094e9487b44671cc6

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Security.Cryptography.Encoding.dll

Filesize
17KB

MD5
f80b936313b8778d2727f27addd09e22

SHA1
994f1d432a328be269592dd963db60c6685113ba

SHA256
09de71671aeaa9c5451d2e17950b94712003eeb00ded3beb213bd6eb98e41c57

SHA512
56f5b155dab8061b19193acf5f20ba60360013444b586c499f2bfdf7f125bd0c6e37c5bd79abd039ab9f533c27e355590638ae7629b62b2b968d1cfd55a2f327

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Windows.Interactivity.dll

Filesize
49KB

MD5
24bd7198db6aa878bdd58c62560db3eb

SHA1
e8b573ffa8a762d0797c0e49ee55281b76f81537

SHA256
adadee387560c99d464850a3b8ae95e6d21ca7c7661c2d5d6db9e2e33abe6463

SHA512
89992150fa84e6fc4ce4e9371cab48290c9f46fb09a5387873eb1d8dcb8ab4e0d13ccda0a1fca995189920a779347ef59f9f585354b618ac426dce2e8a5b1783

Download Submit
C:\Users\Admin\Programs\Downloadly\WinSparkle.dll

Filesize
2.0MB

MD5
598e7f89a37d006066a497440a8fbfd8

SHA1
067508e7621e8106a7d32587d2b17176172417ad

SHA256
f5f8540822f4c449364e0f71fdf85b33dfca50e73bdc0d59dd6de2cbde367bf3

SHA512
f8c2c73498f0e42ed7dadd8b8af257ead79e8404856bf0877cd71028564a9be9e9787fe40b54e5ffe00f863140fa987302a52399143d97b23bcc0df83b12626b

Download Submit
C:\Users\Admin\Programs\Downloadly\libvideo.dll

Filesize
60KB

MD5
0e2101e01d27dcdcb065676702eb7513

SHA1
af1b618fb32eeca3faeafbbfedf2e7a83f7cd50a

SHA256
f666932a8d2f66c01a32df6c7fcb16ef2274eac765b0d085db43d4264139fee1

SHA512
559c80204980729858fb1d7c327e2739f7bdc0bebe57d654e81ac37019963126d958c73b3532457f0ed1bf3ce5532f0f53d6a0187d4c038d485f1c4c32e6ce59

Download Submit
C:\Users\Admin\Programs\Downloadly\log4net.dll

Filesize
274KB

MD5
e4b95eee136c9c270f9b69b72162f300

SHA1
2b774fcfe5072b4c9ad61c9ebe7d0f26a57dc0ab

SHA256
02017ccacc6855755e8568f411ed248394606c004689119b59bb9ec8134caa39

SHA512
223e593a6bfa57353685ab4b5d77cced8c0dbf07ebdbd2b21077460f0a176428e8fea18eda98e65adc5e95844f089bbe5cc07362eda8cc1afdd9a4d5d95c3d46

Download Submit
C:\Users\Admin\Programs\Massive\Massive.exe

Filesize
3.7MB

MD5
42397eb43466f7659053d8bf97497d74

SHA1
a4fe1de9ea08b15bac7ea65b68d14ad3373877e0

SHA256
df6ad67d8d7bcd3129ca0b2377135e379e99380993838b26da0c92f3ce017109

SHA512
fd2c5ccfdcd2f8f7ad458a0f3180973d202bfd4f71578e1da56ccf9eee0fb12276d22e644f9a159db02eca838b4bab1bfe38cf6e7f2a583e5dbb142d72d59646

Download Submit
C:\Users\Admin\Programs\Massive\MiningGpu.dll

Filesize
606KB

MD5
e72cbbe8eee96adc4ccf8a8058d59d6d

SHA1
31236643077f556745d10727943ccc4aa44f3b73

SHA256
7613707891a06b00996f3988c37b6e8c771272bdefde2f29a95ce46637b16b76

SHA512
523e1e438c6f5e25804bdad08618c1b4b5c68aa146b5f9aa780a4c1e4acaff5a5ca9ee1d3661d25cd2a2ffa6089f8ecb9e935a676afff18831f858691f38b611

Download Submit
C:\Users\Admin\Programs\Massive\SysGpuInfoEx.dll

Filesize
92KB

MD5
b412db9083f140cf9054816edf27d258

SHA1
60338ec1b5f4cda1a6fcb851b4058a8dacc12dba

SHA256
2d6113737940a6562cecdc9bd0bd0d9a93be29486e1abbf7cbf82d5fed489be5

SHA512
e5357d7a0b547c7d5d68db9679b0fbdd47b331e048a716fb3be5ea916c91113324f2209db072a63fde7ea8b46d8e44a4a29bce15547d1a99446880c351ad1e36

Download Submit
C:\Users\Admin\Programs\Massive\WinSparkle.dll

Filesize
2.0MB

MD5
9d660209b1e0353f4e28c81929e90eef

SHA1
880db9173e6f6fcf90dc059df41c6576b7df5aa9

SHA256
e403f1550d010c03f7645cbb97a364370b4e831ab725945d75160edf7202e3ce

SHA512
7901c1369c7ec0ea05be995289dd61e5a35d2105a9b4475233fc8326dea7d5b1a68e3d4754887ea0859cf835a4b9b8477684e19942adfb184b33a0e42a511e1f

Download Submit
C:\Users\Admin\Programs\Massive\crashpad_handler.exe

Filesize
514KB

MD5
607a62e1edbee0ef95ca388cab43e5af

SHA1
44d9527140cee1eb32712bf05528546e54752488

SHA256
a9ecea7bc1de86a3fe66f96aa1c402794df4b1ea0170684cc9c08b12120f1ed4

SHA512
1a97f28eb29eb74fb58bddc8a5c242b85608ce70c99de3f4d2d1bf334de25bfc7a296de7f1f798ef87d48c6928720f0fcef7b43a7f9be6d04c007726e50bc090

Download Submit
C:\Users\Admin\Programs\Massive\nvml.dll

Filesize
985KB

MD5
d805b489c366b1a4e2b5cca7c05a1274

SHA1
92ab5416431924dc485649dc54e91bcee7867cb7

SHA256
2b06637175bf7816d3d8d046caef555bfa5b87cc2143403e516c2d8ee053e97b

SHA512
6875f0cbcf3097d43782a462c3933d94e6f6efed6cd207d770edd4c4f75f7bb3028ada9dbb73ddfbcb04a48c0957d5c6b0892014142b5621f91f37d7c0cb6ad1

Download Submit
C:\Users\Admin\Programs\Massive\xmrBridge.dll

Filesize
161KB

MD5
52b18788d85803093e262cc59f6b9ea1

SHA1
39ae3cf445e8c155c040c9f93080fe0952ef98d7

SHA256
c01b3d50d526a7999462152e7949c86fcf1720b3d558eb5bb9d0136e324230ec

SHA512
30b0b7ae7645c4c98403301e170eb80f2bb67325fc294abcd03bdd61b2fd0cec9ee716aae90d632e71503e926b74fe2b91773893d306eb5f5db0957d1dad04a7

Download Submit
memory/720-253-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/720-249-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/720-433-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/840-449-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/840-537-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/880-534-0x0000000000400000-0x000000000074F000-memory.dmp

Filesize
3.3MB

Download
memory/1376-777-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1376-768-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2172-226-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2172-248-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2172-440-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3032-773-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/3712-546-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3712-775-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3960-778-0x0000000000400000-0x000000000074F000-memory.dmp

Filesize
3.3MB

Download
memory/4064-763-0x0000021C071B0000-0x0000021C071F6000-memory.dmp

Filesize
280KB

Download
memory/4064-765-0x0000021C221B0000-0x0000021C22260000-memory.dmp

Filesize
704KB

Download
memory/4064-764-0x0000021C08AD0000-0x0000021C08AE0000-memory.dmp

Filesize
64KB

Download
memory/4064-762-0x0000021C06D40000-0x0000021C06DC8000-memory.dmp

Filesize
544KB

Download
memory/4256-426-0x000001577FD80000-0x000001577FE30000-memory.dmp

Filesize
704KB

Download
memory/4256-427-0x000001577FB90000-0x000001577FBB2000-memory.dmp

Filesize
136KB

Download
memory/4256-420-0x000001577D250000-0x000001577D2D4000-memory.dmp

Filesize
528KB

Download
memory/4256-432-0x000001577F780000-0x000001577F788000-memory.dmp

Filesize
32KB

Download
memory/4256-435-0x000001577F9E0000-0x000001577F9EE000-memory.dmp

Filesize
56KB

Download
memory/4256-424-0x000001577F770000-0x000001577F780000-memory.dmp

Filesize
64KB

Download
memory/4256-434-0x000001577FD10000-0x000001577FD48000-memory.dmp

Filesize
224KB

Download
memory/4256-422-0x000001577F6B0000-0x000001577F6F6000-memory.dmp

Filesize
280KB

Download