hxxps://www[.]westbyte[.]com/dm/

Analysis

max time kernel
322s
max time network
321s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.westbyte.com/dm/
Sample

211014-g4vlmsgbhj

Score

9^/10

adware discovery persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 13 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Program Files (x86)\Download Master\unzip32.dll	acprotect
\Program Files (x86)\Download Master\unzip32.dll	acprotect
C:\Program Files (x86)\Download Master\Plugins\videoserv.dll	acprotect
\Program Files (x86)\Download Master\Plugins\videoserv.dll	acprotect
\Program Files (x86)\Download Master\Plugins\videoserv.dll	acprotect
\Program Files (x86)\Download Master\Plugins\advscheduler.dll	acprotect
\Program Files (x86)\Download Master\Plugins\advscheduler.dll	acprotect
C:\Program Files (x86)\Download Master\Plugins\advscheduler.dll	acprotect
\Program Files (x86)\Download Master\Plugins\botmaster.dll	acprotect
\Program Files (x86)\Download Master\Plugins\botmaster.dll	acprotect
C:\Program Files (x86)\Download Master\Plugins\botmaster.dll	acprotect
\Users\Admin\AppData\Roaming\Download Master\Plugins\videoserv.dll	acprotect
\Users\Admin\AppData\Roaming\Download Master\Plugins\videoserv.dll	acprotect

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

dmaster.exedmaster.tmpdmaster.exeffmpeg.exe

pid process

4576 dmaster.exe
5012 dmaster.tmp
4688 dmaster.exe
2592 ffmpeg.exe

pid	process
4576	dmaster.exe
5012	dmaster.tmp
4688	dmaster.exe
2592	ffmpeg.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files (x86)\Download Master\unzip32.dll	upx
\Program Files (x86)\Download Master\unzip32.dll	upx
C:\Program Files (x86)\Download Master\Plugins\videoserv.dll	upx
\Program Files (x86)\Download Master\Plugins\videoserv.dll	upx
\Program Files (x86)\Download Master\Plugins\videoserv.dll	upx
\Program Files (x86)\Download Master\Plugins\advscheduler.dll	upx
\Program Files (x86)\Download Master\Plugins\advscheduler.dll	upx
C:\Program Files (x86)\Download Master\Plugins\advscheduler.dll	upx
\Program Files (x86)\Download Master\Plugins\botmaster.dll	upx
\Program Files (x86)\Download Master\Plugins\botmaster.dll	upx
C:\Program Files (x86)\Download Master\Plugins\botmaster.dll	upx
\Users\Admin\AppData\Roaming\Download Master\Plugins\videoserv.dll	upx
\Users\Admin\AppData\Roaming\Download Master\Plugins\videoserv.dll	upx
C:\Users\Admin\AppData\Roaming\Download Master\ffmpeg.exe	upx
C:\Users\Admin\AppData\Roaming\Download Master\ffmpeg.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dmaster.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation	dmaster.exe

Loads dropped DLL 15 IoCs

Processes:

regsvr32.exeregsvr32.exedmaster.exe

pid	process
3332	regsvr32.exe
3332	regsvr32.exe
396	regsvr32.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dmaster.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run	dmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Download Master = "C:\\Program Files (x86)\\Download Master\\dmaster.exe -autorun"	dmaster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in Program Files directory 64 IoCs

Processes:

dmaster.tmp

description	ioc	process
File created	C:\Program Files (x86)\Download Master\temp\is-LQ6MD.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-5GPVE.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-34PHE.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-VECKM.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Skins\is-CN6RC.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-SEEVF.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Sounds\is-N0FPE.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\unins000.dat	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-UA0IK.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-BELFT.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-83F29.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Sounds\is-9M0IF.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\dmiehlp.dll	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\Plugins\videoserv.dll	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-8QLCS.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-ST9PT.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-89NFD.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Skins\is-PJ69A.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-SMV43.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-H0CCP.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\temp\downloader.exe	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\temp\downloader_old.exe	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-87UG1.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-IHSNU.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-6U8BO.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Plugins\is-CBUCR.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\dmaster.exe	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\unrar.dll	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-1MSP2.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-5C7AQ.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Plugins\is-A4B1J.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-F7JMS.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\Plugins\remotedownload.dll	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-DAOMT.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-JBPHL.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-900HS.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Sounds\is-6I838.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Plugins\is-PTCS8.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\npdm.dll	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-2MA8K.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-KA6OU.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-K11T5.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-VO994.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-H2CSH.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-S29HU.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-75B8J.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-7SMA9.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-O87C5.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\unzip32.dll	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\Plugins\botmaster.dll	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-227PP.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-63ASL.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\unins000.dat	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\dm_rus.chm	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\Plugins\advscheduler.dll	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Plugins\is-8S1OP.tmp	dmaster.tmp
File opened for modification	C:\Program Files (x86)\Download Master\downloader.exe	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-02IVB.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\Extensions\is-RUKLM.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-8RE1P.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-44HBP.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-IJKN0.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\temp\is-1BVKU.tmp	dmaster.tmp
File created	C:\Program Files (x86)\Download Master\is-LUPH9.tmp	dmaster.tmp

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

dmaster.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo dmaster.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo	dmaster.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a63109125baed701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

dmaster.exeiexplore.exeIEXPLORE.EXEdmaster.tmpMicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Çàêà÷àòü ïðè ïîìîùè Download Master\ = "C:\\Program Files (x86)\\Download Master\\dmie.htm"	dmaster.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E21E028-2F12-11EC-AF2E-4AC12AF62747} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "74"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "755"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "161"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.westbyte.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "101"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "482"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Ïåðåäàòü íà óäàëåííóþ çàêà÷êó DM\ = "C:\\Program Files (x86)\\Download Master\\remdown.htm"	dmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "1445"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\Total = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "738"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dmaster.exe = "11000"	dmaster.tmp
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1445"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\Total = "321"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\Total = "353"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{8DAE90AD-4583-4977-9DD4-4360F7A45C74}\HotIcon = "C:\\Program Files (x86)\\Download Master\\dmaster.exe,210"	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.westbyte.com\ = "129"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{8DAE90AD-4583-4977-9DD4-4360F7A45C74}\MenuStatusBar = "Download Master"	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Çàêà÷àòü ïðè ïîìîùè Download Master\contexts = "34"	dmaster.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\Total = "33"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "222"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\Total = "1282"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\ = "966"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\ = "258"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Çàêà÷àòü ïðè ïîìîùè Download Master	dmaster.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Ïåðåäàòü íà óäàëåííóþ çàêà÷êó DM\contexts = "34"	dmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\ = "321"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "74"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "83"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dmaster.exe = "11000"	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.westbyte.com\ = "11"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2050"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{8DAE90AD-4583-4977-9DD4-4360F7A45C74}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	dmaster.tmp
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "36"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "182"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{8DAE90AD-4583-4977-9DD4-4360F7A45C74}\Exec = "C:\\Program Files (x86)\\Download Master\\dmaster.exe"	dmaster.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{8DAE90AD-4583-4977-9DD4-4360F7A45C74}\ButtonText = "Download Master"	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Çàêà÷àòü ÂÑÅ ïðè ïîìîùè Download Master\contexts = "243"	dmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\westbyte.com\Total = "11"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "850"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Закачать ВСЕ при помощи Download Master	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Закачать ВСЕ при помощи Download Master\contexts = "243"	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Передать на удаленную закачку DM\contexts = "34"	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1127"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\yastatic.net\Total = "966"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\MenuExt\Передать на удаленную закачку DM\ = "C:\\Program Files (x86)\\Download Master\\remdown.htm"	dmaster.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	dmaster.tmp

Modifies registry class 64 IoCs

Processes:

regsvr32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedmaster.tmpregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22D1250D-930F-4DFB-AE98-9FB407679AEB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4533F02-1CEF-4517-AB97-524CF90248AC}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FC88142-1C6D-48FB-9592-2923CEA45815}\ = "IMoveURL"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMFile\DefaultIcon	dmaster.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31DB2428-93BB-43E8-9F31-686C7F8C58DF}\InprocServer32\ = "C:\\PROGRA~2\\DOWNLO~1\\dmie.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMIE.MoveURL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4533F02-1CEF-4517-AB97-524CF90248AC}\TypeLib\ = "{22D1250D-930F-4DFB-AE98-9FB407679AEB}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6FC88142-1C6D-48FB-9592-2923CEA45815}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31DB2428-93BB-43E8-9F31-686C7F8C58DF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DMFile\shell\open\command\ = "C:\\Program Files (x86)\\Download Master\\dmaster.exe \"%L\""	dmaster.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMIE.MoveURL\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7f5b5805c4c0d701	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.urls	dmaster.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FC88142-1C6D-48FB-9592-2923CEA45815}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31DB2428-93BB-43E8-9F31-686C7F8C58DF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dmiehlp.DMIEHelper	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dmiehlp.DMIEHelper\Clsid	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMFile	dmaster.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMUrlsFile\shell	dmaster.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{33D89062-BF1D-4F03-B704-DA3EB1B7E85F}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMFile\shell	dmaster.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.urls\ = "DMUrlsFile"	dmaster.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4533F02-1CEF-4517-AB97-524CF90248AC}\ProgID\ = "DMIE.MoveURL"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000bebddad488dd36d5306af5ab4b00f16ae68948c41c0993956d3730697ba892394761ad41f312c76cfe69acd3bc107ebbb9f6b63d643531b087c1	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMIE.IEDownloadManager\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4533F02-1CEF-4517-AB97-524CF90248AC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{1132EE12-6191-4265-AAEC-3ABD9FEB2544} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31DB2428-93BB-43E8-9F31-686C7F8C58DF}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4533F02-1CEF-4517-AB97-524CF90248AC}\InprocServer32\ = "C:\\PROGRA~2\\DOWNLO~1\\dmie.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9961627E-4059-41B4-8E0E-A7D6B3854ADF}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9961627E-4059-41B4-8E0E-A7D6B3854ADF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9961627E-4059-41B4-8E0E-A7D6B3854ADF}\InprocServer32\ = "C:\\PROGRA~2\\DOWNLO~1\\dmiehlp.dll"	regsvr32.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

dmaster.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\SYSTEM	dmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\SYSTEM\Certificates	dmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\SYSTEM\CRLs	dmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\SYSTEM\CTLs	dmaster.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dmaster.tmp

pid process

5012 dmaster.tmp
5012 dmaster.tmp
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dmaster.exe

pid process

4688 dmaster.exe

pid	process
5012	dmaster.tmp
5012	dmaster.tmp

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	1848	MicrosoftEdge.exe
Token: SeDebugPrivilege	1848	MicrosoftEdge.exe
Token: SeDebugPrivilege	1848	MicrosoftEdge.exe
Token: SeDebugPrivilege	1848	MicrosoftEdge.exe
Token: SeDebugPrivilege	1848	MicrosoftEdge.exe
Token: SeDebugPrivilege	2772	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2772	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2772	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2772	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exedmaster.tmpdmaster.exefirefox.exe

pid	process
3472	iexplore.exe
3472	iexplore.exe
5012	dmaster.tmp
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

dmaster.exefirefox.exe

pid	process
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe
4688	dmaster.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

iexplore.exeIEXPLORE.EXEdmaster.exeMicrosoftEdge.exeMicrosoftEdgeCP.exefirefox.exe

pid	process
3472	iexplore.exe
3472	iexplore.exe
4280	IEXPLORE.EXE
4280	IEXPLORE.EXE
4280	IEXPLORE.EXE
4280	IEXPLORE.EXE
4688	dmaster.exe
1848	MicrosoftEdge.exe
4472	MicrosoftEdgeCP.exe
4472	MicrosoftEdgeCP.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exedmaster.exedmaster.tmpfirefox.exefirefox.exe

description	pid	process	target process
PID 3472 wrote to memory of 4280	3472	iexplore.exe	IEXPLORE.EXE
PID 3472 wrote to memory of 4280	3472	iexplore.exe	IEXPLORE.EXE
PID 3472 wrote to memory of 4280	3472	iexplore.exe	IEXPLORE.EXE
PID 3472 wrote to memory of 4576	3472	iexplore.exe	dmaster.exe
PID 3472 wrote to memory of 4576	3472	iexplore.exe	dmaster.exe
PID 3472 wrote to memory of 4576	3472	iexplore.exe	dmaster.exe
PID 4576 wrote to memory of 5012	4576	dmaster.exe	dmaster.tmp
PID 4576 wrote to memory of 5012	4576	dmaster.exe	dmaster.tmp
PID 4576 wrote to memory of 5012	4576	dmaster.exe	dmaster.tmp
PID 5012 wrote to memory of 3332	5012	dmaster.tmp	regsvr32.exe
PID 5012 wrote to memory of 3332	5012	dmaster.tmp	regsvr32.exe
PID 5012 wrote to memory of 3332	5012	dmaster.tmp	regsvr32.exe
PID 5012 wrote to memory of 396	5012	dmaster.tmp	regsvr32.exe
PID 5012 wrote to memory of 396	5012	dmaster.tmp	regsvr32.exe
PID 5012 wrote to memory of 396	5012	dmaster.tmp	regsvr32.exe
PID 5012 wrote to memory of 4688	5012	dmaster.tmp	dmaster.exe
PID 5012 wrote to memory of 4688	5012	dmaster.tmp	dmaster.exe
PID 5012 wrote to memory of 4688	5012	dmaster.tmp	dmaster.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4996 wrote to memory of 4892	4996	firefox.exe	firefox.exe
PID 4892 wrote to memory of 684	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 684	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe
PID 4892 wrote to memory of 5012	4892	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.westbyte.com/dm/
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3472 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\dmaster.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\dmaster.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576

C:\Users\Admin\AppData\Local\Temp\is-1ESUC.tmp\dmaster.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1ESUC.tmp\dmaster.tmp" /SL5="$2021A,7072878,121344,C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\dmaster.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Download Master\dmie.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:3332

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Download Master\dmiehlp.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:396

C:\Program Files (x86)\Download Master\dmaster.exe
"C:\Program Files (x86)\Download Master\dmaster.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Users\Admin\AppData\Roaming\Download Master\ffmpeg.exe
"C:\Users\Admin\AppData\Roaming\Download Master\ffmpeg.exe" -i "C:\Users\Admin\Downloads\extremely rare 0 yard NFL punt_a.mp4" -i "C:\Users\Admin\Downloads\extremely rare 0 yard NFL punt.mp4.DMF" -c:a copy -c:v copy "C:\Users\Admin\Downloads\extremely rare 0 yard NFL punt.mp4"
5⤵
- Executes dropped EXE
PID:2592

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1848

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.0.210293173\1389205838" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1544 -prefsLen 1 -prefMapSize 219808 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 1652 gpu
3⤵
PID:684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.3.278832072\1520995408" -childID 1 -isForBrowser -prefsHandle 2312 -prefMapHandle 2308 -prefsLen 122 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 2324 tab
3⤵
PID:5012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.13.1263277917\1797565183" -childID 2 -isForBrowser -prefsHandle 3436 -prefMapHandle 3432 -prefsLen 6979 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 3416 tab
3⤵
PID:1684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.20.1686019976\199043134" -childID 3 -isForBrowser -prefsHandle 4648 -prefMapHandle 4384 -prefsLen 7907 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 4684 tab
3⤵
PID:516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Download Master\Extensions\dm@westbyte.com.xpi
MD5
7b5261cbaaec8149ee770e3a4b943b1a

SHA1
e8acf08eb0499bf91a002c3384b15dd7d4b22088

SHA256
3dc431f6ffbcf2d8236fc4c00eda17465527eac98e89f9283e1bbab557ef5ce2

SHA512
7895ff2297bbef267e65b81abbd9d7de98edd5aa8dcd312d5d8321bcc08b17c12c8b2f630bd9df87f74d3a8d6afc07455f5d6c8ecb103c6a2db48225ec81aafd

Download Submit
C:\Program Files (x86)\Download Master\Extensions\dmbarff@westbyte.com.xpi
MD5
f714ca78f383dc4e61c4a6b407562a75

SHA1
162e8f6ce0829e062c2d42c534d72c7cd8899497

SHA256
7717cff48a48860e0873cc4a2b36c077c82d06d6f721526bc4518521d6a1cd07

SHA512
9afc9a5a16c2e36e4b5420517302474fd5da3c37c90dc057745515fced6ebbc60e87e3a3ec442cea7471e8c6588c08f3311c988127c8f3280e91ab60f7a61f5e

Download Submit
C:\Program Files (x86)\Download Master\Plugins\advscheduler.dll
MD5
e2af2f93e7d1db2119b1a03292d75ac2

SHA1
998c95aebf41a82bccda6cf52e5fe48eb9c47683

SHA256
e6549cab193396e65c034c716a326e9b85baf86a7300430d6729eb3f6137af2c

SHA512
a39aba6682388526af69e7cdb14ac3c6ea09f4e64bc2f518b79ab4f6b18ddd7597805515fa8ba7656bbf7719abbe69c313461c0c897e2b2d02c8616011595fb9

Download Submit
C:\Program Files (x86)\Download Master\Plugins\botmaster.dll
MD5
f32c1bda6922633245804ea84e55dcc0

SHA1
80ac467eb71c92ed970b21f8eb83fe6aeaa623ec

SHA256
2c4cfee81092f3e49d1d3af7bcbd917bd30bdac9dab57f3e200f59f805cff209

SHA512
712ccc45dd0bd399ec47424d2706a4af3c7a86ab5ef9a34dcdd4fca170fb0146b581d7f5a3825516e89dd24fd69662e18857a1cf841a13e7cffeb1d893b414ff

Download Submit
C:\Program Files (x86)\Download Master\Plugins\remotedownload.dll
MD5
8d8ac3e961e45ce7a2a929931c7e18f0

SHA1
02c95bd0d01755d17eaf471021eea1cd59c3b859

SHA256
a65a3250f892c2a5c4ab035992a0b602cdc170ad0a7a96ebab0980c34977a081

SHA512
92874fb14e1e87f860c5fa6d4b4d80f3120524adb7986b4cbf2d5df964020477cefc734be1e5401a2ba19e650277f78dd318649edc0157ccaac4e1db07060a88

Download Submit
C:\Program Files (x86)\Download Master\Plugins\videoserv.dll
MD5
2792d3f67b6cee10a9c0cd5d1e98efda

SHA1
a9aecb387b85fc9f2eb368578cb3ae0917a0cd59

SHA256
0ba76db695f8cf004d9f645220cb0f5d88d5dffd62a01d7f0102be7d7380c868

SHA512
14c111f67f8af846afc4c785c0a2cf011fbb64560aac926c7c97f773bf397e0dee8ac13c5e7ce96fa08ed8dca8a04170de52fe1be13c8b2efe9ade802db79073

Download Submit
C:\Program Files (x86)\Download Master\Skins\Standard.skn
MD5
3b04357247712abb24f1ecbb92889a29

SHA1
c0309dd24c9bc7eb528024ab221649c9f1ff8ee3

SHA256
addd9b02b9ad491ff5c1fd34df76278d5bdc1229ba5bec1f5fe46b338fc698e5

SHA512
8a50746a95fa7ce35b9c9f62cd23c45924c72171489cb57967cfbe177ae95370e4421cdad3d0761dacb92e84b8ad1967087738b4cf7ec00196e7d2e85e998b8b

Download Submit
C:\Program Files (x86)\Download Master\Sounds\add.wav
MD5
544baba50fa42550c9f83cbd3627b185

SHA1
d1e57be5c303d3aa9845bafd0635718c1b991100

SHA256
3ba90a165a154487bee66ec03d1b4c7d3c514cf84b076aaef8e83c0ef147518a

SHA512
d64e1ea69e9d0c858874597b611006944b13845d567f309b45419dd92944ca66413cf60159fff64329f1db71fb37b04c2ace5173f90488d3b278921bcfe9aff3

Download Submit
C:\Program Files (x86)\Download Master\Sounds\alldone.wav
MD5
8d1f9013625fb93700fd0bca930926f7

SHA1
93e906bc6b7d034ee34ea12d3a0a4a6342a5ff33

SHA256
ccca7382282c08a282e336f5d865a4d1b4f0abe77fd0cb7e6a1a02dfccb39ee5

SHA512
1c652d99645d30f89897a9e621363461e156e6e2ef2e7c4ac8d1be3df5a6fe5b76019090815ea4a9d88d307689922cfeaf098ed02a5ee660af8d9fc40b327f73

Download Submit
C:\Program Files (x86)\Download Master\bugtype_e.cfg
MD5
4e045bbf332997627ccea8f34d2bc35a

SHA1
365eb578636b8063bf4a3aee05e0f4eff22f5dfa

SHA256
12b7f3ffb57586776259978a057fcc4cdaf99f96dfac5d152655b58d7f1885d9

SHA512
b388071105b1004485d1573216ef80a6fe722745cf28be134af849199502262b9d6176c5cfb1e4f06fe5e3934e0654f44911d588bd157daea09f5d60a7e69b46

Download Submit
C:\Program Files (x86)\Download Master\dmaster.exe
MD5
cb03a9f43c59523c812b89f539509237

SHA1
2fbc7ede4d5fe8f59b093220526ba1dbc08a7734

SHA256
01805fe80e168fa9b0e4bea1c060e2283341d8717044a36f77586fadbda01f48

SHA512
9f6a7b6364d8bce7daff63371c940ae4001b76bfe8c7b78a1cbdca23cc2de3dd5e80808b3435e09f9c1c1f5a003399d43232ba7c0e337e42a9ad161010b4ec54

Download Submit
C:\Program Files (x86)\Download Master\dmaster.exe
MD5
cb03a9f43c59523c812b89f539509237

SHA1
2fbc7ede4d5fe8f59b093220526ba1dbc08a7734

SHA256
01805fe80e168fa9b0e4bea1c060e2283341d8717044a36f77586fadbda01f48

SHA512
9f6a7b6364d8bce7daff63371c940ae4001b76bfe8c7b78a1cbdca23cc2de3dd5e80808b3435e09f9c1c1f5a003399d43232ba7c0e337e42a9ad161010b4ec54

Download Submit
C:\Program Files (x86)\Download Master\dmaster4.dat
MD5
17e0ca37d4edfc694640b63ee0782d1d

SHA1
d5a1e3b86255571cfde7572d2df6ff808e0ec7ee

SHA256
97c5ba9bd1eb25d95c688bb3a7b958a5832a1bcc7ac82c69c0d93451b7383db9

SHA512
512ff3e08b499a1a67a27c6667df199b34062fbfc74999f2accc41f73f5cdda2cdc53f5f35aaffe06d73fbefffc143a800e177a31510339781df903853812169

Download Submit
C:\Program Files (x86)\Download Master\dmie.dll
MD5
464632653b8ef1febda37d5efc44aeee

SHA1
bd114b3af59a4a7c42234ee8908fac0d7beb23f0

SHA256
ab7f9245c46507a18d4a96747a8b33e8b0b5ee78fb7b99b8d9833496a5c52af2

SHA512
6b113f0e3c25b69f27c3e8a173240f536621234d50013f668171e680bbd796f1f8859ece9b7c4af337a05fbe2cf87595152924956a6147dfd9a6583fd908b368

Download Submit
C:\Program Files (x86)\Download Master\dmiehlp.dll
MD5
ece3d898b9a156dec1cbbb88108f693f

SHA1
68839ede5155c6d86f46f85988ec109d7b3713f4

SHA256
03a41f5572b5c872ba0b8cf05c5ca3a3f51d2ee34a2dc95b4b9c63d4a30b289a

SHA512
6d5b483e2da474ed4b34a2ffbfa050215c79ab93814bce56e42b7ed07350f969147778a3f4db9a15b499a5929692df29d4348a62f8723978294df2a161691bd7

Download Submit
C:\Program Files (x86)\Download Master\hintf.bmp
MD5
d97ac2dc81cea733a6bc49e609b75213

SHA1
85abd47e2ab8bdbc201325795c104a7d3497fed2

SHA256
af207dcde55fff6a1597c3e16764b58841197930ed2909f5075b44053c5c5afe

SHA512
3ffb1eaea942f448c82bb61f089140ba278886487ba1b452311efc9904aefec5596328df26a450dde5e622b751a692c519335bea88bba9c1b3f26cf79423270f

Download Submit
C:\Program Files (x86)\Download Master\lvcolors.cfg
MD5
69031e6ed2e4b83bf7b9d187347c0190

SHA1
27a5c366b206278fa785121541323c8553211a0d

SHA256
d90950f0ccc19fe055a0ea13832a0614eea8d80594180c20a7849918cf4224b5

SHA512
0bab3364fed611018da297a23ae845383c8630b033266f35ba025999bbf460995e267c5e90f2ebe287e7b1fd53e8a940012417978a014c2224c9a2333f508229

Download Submit
C:\Program Files (x86)\Download Master\nodelist.xml
MD5
afd964c0a9a441d7397218779a59b56c

SHA1
78254a73e01d8fdb295de5f3556b39225059c2ed

SHA256
3b1d21b350487001c3852727119ee55607f870cd23494e89c983ceb1c10090ee

SHA512
4d068982941e2de162ee08cb5d176a071f7226be3516461e12a2eb65a09d9679a33db1a71117fbea9c22eae3cb94b112ee7a5d8d7506994ad4a409c7dde531d8

Download Submit
C:\Program Files (x86)\Download Master\referers.txt
MD5
a0d6298382365ca3d88f0b0b7f07ff84

SHA1
b60b2341dcf74cf95ca4d48429a75ceeaf425aa4

SHA256
e35e4ae517a16d8811c7bac92228894a95bacb8a78136a20927be092ca03664b

SHA512
60b61336526a33b522b835443476cf13b1672c240a7a77f52c564cc9d5216ce57fc0c2b2b44acf04a997be62cb0aea682dbcce00754f7e6cffb7c8e0c5c8ec37

Download Submit
C:\Program Files (x86)\Download Master\temp\dban_b205.jpg
MD5
ded4857dc3d3e163200d6cfdd3d37812

SHA1
7bd273a29c1d391820935e61f33069cde72e390a

SHA256
c9f44653c9952dee6182a79da8d441d51b873e9286e9c2829b3004390b380a43

SHA512
c0ad3e61ffa6542b3636dd48870773f220f8cdd888adc260c65aebee3967d61763fe81b8ae1da8c26a98464c2ce2a1fdca98fe481363b99a35dedc6e9e2f1091

Download Submit
C:\Program Files (x86)\Download Master\temp\dbans.lnk
MD5
3f42d2bd78c3a93d7ea5002a4f283db7

SHA1
b45f67c12947b44a06c781b156c22d7a218a90c8

SHA256
2ece12916d2620e96715bbfcfdea0fa94863d2f4501fec2aca3b74a0d0dc2fe2

SHA512
88cc595cff70870f3a500e9fce2ceacef93fa47cb68a1f01f785bc2ff558bcbef2057da3c5f7a16b1f84584f843d56f771da35d778be0a2605d54debfa19b023

Download Submit
C:\Program Files (x86)\Download Master\typeconn.cfg
MD5
720371839624c0e1c3ede84a80fe31fb

SHA1
9b7cb75a6c9d3f3e922efea0ef7e4e89b1f995b8

SHA256
ee07e7aed21902c95c54aa8cb27aa2175c9e89e6845482f0881be6d562febc90

SHA512
190668f595a75d7c5a14cf930b3fc5857e065c4a4fa6a5b0029823de071833bf2bc2989484cf21ce186252ceddd72dd19999f4dfeaaea5098040cedf066bb261

Download Submit
C:\Program Files (x86)\Download Master\unrar.dll
MD5
2fc227e035465dd4e919109e7bbbd5dd

SHA1
2bddec34e0a96bc64e7e65c9a36ee66cf1306c47

SHA256
3282a2e45b60b071a1c73711c9be47ff92086ef64896b99e75b0e0bdde0166b8

SHA512
042879ee001498b28387a62c9294e0984f0f6d44804afb131dd01b3e18000a371636d8a56dfd468033468b0a551bdc35dfa69cfcc8cdf038b3da3976d0146139

Download Submit
C:\Program Files (x86)\Download Master\unzip32.dll
MD5
28b6d614f3534c9f1f81b83b9f63e770

SHA1
94e66b25313c325d8325a906d6ce855943be881f

SHA256
03c197713f23eec900b65ac17c4c2660419de99a3807fb36128458b0840a8748

SHA512
cbbb627460cbbd9e32075cce50b58d89d535db46bca3330935ae13a3ebb09f3f7de6cbc859852f87e7da38f146c7d3201c0a39ab581e8adbf9c322333b15d713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\dmaster.exe
MD5
84c4021135555ce4384f22c66ba4595b

SHA1
74a4051dc39188c1b90768204707ef641881ebf4

SHA256
0af06fb0a98f36849371c928af03a39c57e7596b32c806da9f358651714a2ac7

SHA512
1d43f69d504c890c3c050cfe05c6553cc3984cf5e0c6801c4c88cd1b53d935f507056b8aa060dd3d41af988146d3404ccadb143d002df155f6ae3d1e9dda0a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\dmaster.exe.pe7353a.partial
MD5
84c4021135555ce4384f22c66ba4595b

SHA1
74a4051dc39188c1b90768204707ef641881ebf4

SHA256
0af06fb0a98f36849371c928af03a39c57e7596b32c806da9f358651714a2ac7

SHA512
1d43f69d504c890c3c050cfe05c6553cc3984cf5e0c6801c4c88cd1b53d935f507056b8aa060dd3d41af988146d3404ccadb143d002df155f6ae3d1e9dda0a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SRIM9EVC.cookie
MD5
9e79fbabd475d1e4a14c8c6b3c2e485c

SHA1
6544796e1f094f8efc6f407be06bbb5fb47010c5

SHA256
09f4014559d27ca0dddaf2664c7276f69a9e1de1ab724e4ba28076ba7949985a

SHA512
c01b9187eecaf885c41556e5b27f6589fe28fe1753f13f10046a895d334bb06bed0b1e9b838b621f8361dfc53f4a3d3a8770bd80f8360a122b3b07b453444987

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1ESUC.tmp\dmaster.tmp
MD5
50bed2bd35a9a3f6061d7024a17d95ba

SHA1
6804ac3b28a3605cfd70c83573e43a52c3b6666e

SHA256
a808ead5636289e1909533957c96a93fb717d9494b4c271d07bfbd6c030a5314

SHA512
aced9c20256cea52b7b77f1d95eef21f11fef52957434dc1a81898c57206f36981d885da8883d7f1b83ffc69feaf95845e7e3d60dfdf6f18ff5dd48a57c8986e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1ESUC.tmp\dmaster.tmp
MD5
50bed2bd35a9a3f6061d7024a17d95ba

SHA1
6804ac3b28a3605cfd70c83573e43a52c3b6666e

SHA256
a808ead5636289e1909533957c96a93fb717d9494b4c271d07bfbd6c030a5314

SHA512
aced9c20256cea52b7b77f1d95eef21f11fef52957434dc1a81898c57206f36981d885da8883d7f1b83ffc69feaf95845e7e3d60dfdf6f18ff5dd48a57c8986e

Download Submit
C:\Users\Admin\AppData\Roaming\Download Master\ffmpeg.exe
MD5
e905c137f320093bee0d5e8beaeebf09

SHA1
edb8f3136fb767a6419ddea56958593359c98389

SHA256
2bb8a4004e0dfaeeba824f0ebf6f98c38ce6402948c685aaf684ff3aa772b728

SHA512
cd63e18c46c77dc37120b5df69dd9ec89f729c46458c095947ca3368cf09faf0cd70e91e08091dfd49cc1570c336dd06ca7ec37375bba01c71407c66ae9fb0d8

Download Submit
C:\Users\Admin\AppData\Roaming\Download Master\ffmpeg.exe
MD5
f2fe9ff61c42d2e1fe5d232539aa4ec7

SHA1
e714aaef9dab4e9b58705a1cdeb69098fa465a19

SHA256
02e0bdfa8095ec3c05b49353d224e0c85dd419652947360b79cc09aaaa013773

SHA512
6bfbe62d7f06caaf25b427dd1c9488a5daf06b88ad5c2a4b26c8789863437b2c37aa734d64a65b6d8db0bf971388cf30c79fd5b74bc4d0894c54c88c597c35dd

Download Submit
\Program Files (x86)\Download Master\Plugins\advscheduler.dll
MD5
e2af2f93e7d1db2119b1a03292d75ac2

SHA1
998c95aebf41a82bccda6cf52e5fe48eb9c47683

SHA256
e6549cab193396e65c034c716a326e9b85baf86a7300430d6729eb3f6137af2c

SHA512
a39aba6682388526af69e7cdb14ac3c6ea09f4e64bc2f518b79ab4f6b18ddd7597805515fa8ba7656bbf7719abbe69c313461c0c897e2b2d02c8616011595fb9

Download Submit
\Program Files (x86)\Download Master\Plugins\advscheduler.dll
MD5
e2af2f93e7d1db2119b1a03292d75ac2

SHA1
998c95aebf41a82bccda6cf52e5fe48eb9c47683

SHA256
e6549cab193396e65c034c716a326e9b85baf86a7300430d6729eb3f6137af2c

SHA512
a39aba6682388526af69e7cdb14ac3c6ea09f4e64bc2f518b79ab4f6b18ddd7597805515fa8ba7656bbf7719abbe69c313461c0c897e2b2d02c8616011595fb9

Download Submit
\Program Files (x86)\Download Master\Plugins\botmaster.dll
MD5
f32c1bda6922633245804ea84e55dcc0

SHA1
80ac467eb71c92ed970b21f8eb83fe6aeaa623ec

SHA256
2c4cfee81092f3e49d1d3af7bcbd917bd30bdac9dab57f3e200f59f805cff209

SHA512
712ccc45dd0bd399ec47424d2706a4af3c7a86ab5ef9a34dcdd4fca170fb0146b581d7f5a3825516e89dd24fd69662e18857a1cf841a13e7cffeb1d893b414ff

Download Submit
\Program Files (x86)\Download Master\Plugins\botmaster.dll
MD5
f32c1bda6922633245804ea84e55dcc0

SHA1
80ac467eb71c92ed970b21f8eb83fe6aeaa623ec

SHA256
2c4cfee81092f3e49d1d3af7bcbd917bd30bdac9dab57f3e200f59f805cff209

SHA512
712ccc45dd0bd399ec47424d2706a4af3c7a86ab5ef9a34dcdd4fca170fb0146b581d7f5a3825516e89dd24fd69662e18857a1cf841a13e7cffeb1d893b414ff

Download Submit
\Program Files (x86)\Download Master\Plugins\remotedownload.dll
MD5
8d8ac3e961e45ce7a2a929931c7e18f0

SHA1
02c95bd0d01755d17eaf471021eea1cd59c3b859

SHA256
a65a3250f892c2a5c4ab035992a0b602cdc170ad0a7a96ebab0980c34977a081

SHA512
92874fb14e1e87f860c5fa6d4b4d80f3120524adb7986b4cbf2d5df964020477cefc734be1e5401a2ba19e650277f78dd318649edc0157ccaac4e1db07060a88

Download Submit
\Program Files (x86)\Download Master\Plugins\remotedownload.dll
MD5
8d8ac3e961e45ce7a2a929931c7e18f0

SHA1
02c95bd0d01755d17eaf471021eea1cd59c3b859

SHA256
a65a3250f892c2a5c4ab035992a0b602cdc170ad0a7a96ebab0980c34977a081

SHA512
92874fb14e1e87f860c5fa6d4b4d80f3120524adb7986b4cbf2d5df964020477cefc734be1e5401a2ba19e650277f78dd318649edc0157ccaac4e1db07060a88

Download Submit
\Program Files (x86)\Download Master\Plugins\videoserv.dll
MD5
2792d3f67b6cee10a9c0cd5d1e98efda

SHA1
a9aecb387b85fc9f2eb368578cb3ae0917a0cd59

SHA256
0ba76db695f8cf004d9f645220cb0f5d88d5dffd62a01d7f0102be7d7380c868

SHA512
14c111f67f8af846afc4c785c0a2cf011fbb64560aac926c7c97f773bf397e0dee8ac13c5e7ce96fa08ed8dca8a04170de52fe1be13c8b2efe9ade802db79073

Download Submit
\Program Files (x86)\Download Master\Plugins\videoserv.dll
MD5
2792d3f67b6cee10a9c0cd5d1e98efda

SHA1
a9aecb387b85fc9f2eb368578cb3ae0917a0cd59

SHA256
0ba76db695f8cf004d9f645220cb0f5d88d5dffd62a01d7f0102be7d7380c868

SHA512
14c111f67f8af846afc4c785c0a2cf011fbb64560aac926c7c97f773bf397e0dee8ac13c5e7ce96fa08ed8dca8a04170de52fe1be13c8b2efe9ade802db79073

Download Submit
\Program Files (x86)\Download Master\dmie.dll
MD5
464632653b8ef1febda37d5efc44aeee

SHA1
bd114b3af59a4a7c42234ee8908fac0d7beb23f0

SHA256
ab7f9245c46507a18d4a96747a8b33e8b0b5ee78fb7b99b8d9833496a5c52af2

SHA512
6b113f0e3c25b69f27c3e8a173240f536621234d50013f668171e680bbd796f1f8859ece9b7c4af337a05fbe2cf87595152924956a6147dfd9a6583fd908b368

Download Submit
\Program Files (x86)\Download Master\dmie.dll
MD5
464632653b8ef1febda37d5efc44aeee

SHA1
bd114b3af59a4a7c42234ee8908fac0d7beb23f0

SHA256
ab7f9245c46507a18d4a96747a8b33e8b0b5ee78fb7b99b8d9833496a5c52af2

SHA512
6b113f0e3c25b69f27c3e8a173240f536621234d50013f668171e680bbd796f1f8859ece9b7c4af337a05fbe2cf87595152924956a6147dfd9a6583fd908b368

Download Submit
\Program Files (x86)\Download Master\dmiehlp.dll
MD5
ece3d898b9a156dec1cbbb88108f693f

SHA1
68839ede5155c6d86f46f85988ec109d7b3713f4

SHA256
03a41f5572b5c872ba0b8cf05c5ca3a3f51d2ee34a2dc95b4b9c63d4a30b289a

SHA512
6d5b483e2da474ed4b34a2ffbfa050215c79ab93814bce56e42b7ed07350f969147778a3f4db9a15b499a5929692df29d4348a62f8723978294df2a161691bd7

Download Submit
\Program Files (x86)\Download Master\unrar.dll
MD5
2fc227e035465dd4e919109e7bbbd5dd

SHA1
2bddec34e0a96bc64e7e65c9a36ee66cf1306c47

SHA256
3282a2e45b60b071a1c73711c9be47ff92086ef64896b99e75b0e0bdde0166b8

SHA512
042879ee001498b28387a62c9294e0984f0f6d44804afb131dd01b3e18000a371636d8a56dfd468033468b0a551bdc35dfa69cfcc8cdf038b3da3976d0146139

Download Submit
\Program Files (x86)\Download Master\unzip32.dll
MD5
28b6d614f3534c9f1f81b83b9f63e770

SHA1
94e66b25313c325d8325a906d6ce855943be881f

SHA256
03c197713f23eec900b65ac17c4c2660419de99a3807fb36128458b0840a8748

SHA512
cbbb627460cbbd9e32075cce50b58d89d535db46bca3330935ae13a3ebb09f3f7de6cbc859852f87e7da38f146c7d3201c0a39ab581e8adbf9c322333b15d713

Download Submit
\Users\Admin\AppData\Roaming\Download Master\Plugins\videoserv.dll
MD5
bb67a2210a06f8047417912f25e0a92c

SHA1
13a5d3fd18ec0e56e6d3a2fa88b39d32c31ed7fd

SHA256
5f423726c2746fcd665060d6b23e148300004e65bae77038736ee7e05a8bcf56

SHA512
207018dc5c02c1ea20b1f3d86c29b86e58794e573cb6be67e7a0ca9a9db01ddf7a013d075cbddff09a23e60a058a263a5d3b4ed1d0a4011d268555de7409211a

Download Submit
\Users\Admin\AppData\Roaming\Download Master\Plugins\videoserv.dll
MD5
bb67a2210a06f8047417912f25e0a92c

SHA1
13a5d3fd18ec0e56e6d3a2fa88b39d32c31ed7fd

SHA256
5f423726c2746fcd665060d6b23e148300004e65bae77038736ee7e05a8bcf56

SHA512
207018dc5c02c1ea20b1f3d86c29b86e58794e573cb6be67e7a0ca9a9db01ddf7a013d075cbddff09a23e60a058a263a5d3b4ed1d0a4011d268555de7409211a

Download Submit
memory/396-209-0x0000000000000000-mapping.dmp

Download
memory/2592-257-0x0000000000000000-mapping.dmp

Download
memory/3332-204-0x0000000000000000-mapping.dmp

Download
memory/3472-179-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-173-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-115-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-155-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-156-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-149-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-157-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-147-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-180-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-151-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-178-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-145-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-177-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-116-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-144-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-142-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-141-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-176-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-117-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-175-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-119-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-138-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-137-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-136-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-135-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-133-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-132-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-120-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-150-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-131-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-129-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-170-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-169-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-128-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-168-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-167-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-166-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-127-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-165-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-125-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-123-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-124-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-122-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-121-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-164-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/3472-163-0x00007FFB85290000-0x00007FFB852FB000-memory.dmp

Filesize
428KB

Download
memory/4280-140-0x0000000000000000-mapping.dmp

Download
memory/4576-188-0x0000000000000000-mapping.dmp

Download
memory/4576-201-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4688-253-0x0000000000B50000-0x0000000000C9A000-memory.dmp

Filesize
1.3MB

Download
memory/4688-219-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/4688-212-0x0000000000000000-mapping.dmp

Download
memory/5012-199-0x0000000000000000-mapping.dmp

Download
memory/5012-202-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download