Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\DMFile\shell\open\command] '' = '%ProgramFiles%\Download Master\dmaster.exe "%L"'
- [<HKLM>\SOFTWARE\Classes\DMUrlsFile\shell\open\command] '' = '%ProgramFiles%\Download Master\dmaster.exe "%L"'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{8DAE90AD-4583-4977-9DD4-4360F7A45C74}] 'Exec' = '%ProgramFiles%\Download Master\dmaster.exe'
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\dmaster.ini
- %ProgramFiles%\Download Master\Plugins\is-H289Q.tmp
- %ProgramFiles%\Download Master\Plugins\is-U4FK6.tmp
- %ProgramFiles%\Download Master\Plugins\is-O0ASG.tmp
- %ProgramFiles%\Download Master\Plugins\is-0EL5Q.tmp
- %ProgramFiles%\Download Master\Sounds\is-HUDKN.tmp
- %ProgramFiles%\Download Master\Sounds\is-O3QHB.tmp
- %ProgramFiles%\Download Master\Sounds\is-R48KH.tmp
- %APPDATA%\Download Master\lists\is-9BGI9.tmp
- %ProgramFiles%\Download Master\Sounds\is-6CEN7.tmp
- %ProgramFiles%\Download Master\Plugins\is-U4282.tmp
- %ProgramFiles%\Download Master\Extensions\is-0VAR9.tmp
- %ProgramFiles%\Download Master\Extensions\is-GUBEP.tmp
- %ProgramFiles%\Download Master\Extensions\is-M54KH.tmp
- %ProgramFiles%\Download Master\is-8RNAH.tmp
- %ProgramFiles%\Download Master\is-D86DV.tmp
- %ProgramFiles%\Download Master\is-K4QON.tmp
- %ProgramFiles%\Download Master\Skins\is-TH3F7.tmp
- %ProgramFiles%\Download Master\is-G429T.tmp
- %ProgramFiles%\Download Master\is-U7D28.tmp
- %ProgramFiles%\Download Master\is-QD578.tmp
- %ProgramFiles%\Download Master\Skins\is-GTJ8A.tmp
- %ProgramFiles%\Download Master\Skins\is-QFSR7.tmp
- %ProgramFiles%\Download Master\Skins\is-AT5Q8.tmp
- %ProgramFiles%\Download Master\Skins\is-4FMP4.tmp
- %ProgramFiles%\Download Master\Skins\is-BB9M4.tmp
- %ProgramFiles%\Download Master\Skins\is-5DML0.tmp
- %ProgramFiles%\Download Master\Skins\is-GLMTK.tmp
- %ProgramFiles%\Download Master\Skins\is-38H2C.tmp
- %ProgramFiles%\Download Master\Skins\is-VOOKJ.tmp
- %ProgramFiles%\Download Master\Skins\is-JTG23.tmp
- %ProgramFiles%\Download Master\Skins\is-LSFR7.tmp
- %ProgramFiles%\Download Master\Skins\is-MNJK3.tmp
- %ProgramFiles%\Download Master\is-1F6NU.tmp
- %APPDATA%\Download Master\is-E18PO.tmp
- %ProgramFiles%\Download Master\is-TA8HC.tmp
- %ProgramFiles%\Download Master\is-GKR7H.tmp
- %ProgramFiles%\Download Master\is-L6HOD.tmp
- %ProgramFiles%\Download Master\is-OFIJT.tmp
- %HOMEPATH%\Desktop\Download Master.lnk
- %ProgramFiles%\Download Master\is-ILOF0.tmp
- %ProgramFiles%\Download Master\is-QQF59.tmp
- %TEMP%\is-5385O.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-5SRLH.tmp\dmaster.tmp
- %TEMP%\RarSFX0\dmaster.exe
- %TEMP%\RarSFX0\Vista Inspirat.skn
- %TEMP%\RarSFX0\Sky.skn
- %TEMP%\RarSFX0\Oskar.skn
- %TEMP%\RarSFX0\Noia.skn
- %TEMP%\is-5385O.tmp\_isetup\_shfoldr.dll
- %TEMP%\RarSFX0\MediaVista-R2.skn
- %TEMP%\RarSFX0\MediaVista-G2.skn
- %TEMP%\RarSFX0\MediaVista-G.skn
- %TEMP%\RarSFX0\MediaVista-B2.skn
- %TEMP%\RarSFX0\MediaVista-B.skn
- %TEMP%\RarSFX0\JDs.skn
- %TEMP%\RarSFX0\Icandy.skn
- %TEMP%\RarSFX0\settings.reg
- %TEMP%\RarSFX0\MediaVista-R.skn
- %TEMP%\is-5385O.tmp\ISTask.dll
- %TEMP%\is-5385O.tmp\VclStylesInno.dll
- %TEMP%\is-5385O.tmp\MetroBlue.vsf
- %ProgramFiles%\Download Master\is-1JFGK.tmp
- %ProgramFiles%\Download Master\is-1V4FO.tmp
- %ProgramFiles%\Download Master\is-IQLG7.tmp
- %ProgramFiles%\Download Master\is-S008O.tmp
- %ProgramFiles%\Download Master\is-1AO1T.tmp
- %ProgramFiles%\Download Master\is-FLCB0.tmp
- %ProgramFiles%\Download Master\is-NG8U8.tmp
- %ProgramFiles%\Download Master\is-DHCRC.tmp
- %ProgramFiles%\Download Master\is-V3TJ1.tmp
- %ProgramFiles%\Download Master\is-U6531.tmp
- %ProgramFiles%\Download Master\is-KR9L9.tmp
- %ProgramFiles%\Download Master\is-SJSPC.tmp
- %ProgramFiles%\Download Master\is-05038.tmp
- %ProgramFiles%\Download Master\is-TFPU2.tmp
- %ProgramFiles%\Download Master\is-1VUMF.tmp
- %ProgramFiles%\Download Master\is-SD330.tmp
- %TEMP%\is-5385O.tmp\WizardForm.BitmapImage1.bmp
- %ProgramFiles%\Download Master\is-SRVTS.tmp
- %ProgramFiles%\Download Master\unins000.dat
Deletes the following files:
- %TEMP%\is-5385O.tmp\ISTask.dll
- %TEMP%\is-5385O.tmp\MetroBlue.vsf
- %TEMP%\is-5385O.tmp\VclStylesInno.dll
- %TEMP%\is-5385O.tmp\WizardForm.BitmapImage1.bmp
- %TEMP%\is-5385O.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-5385O.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %ProgramFiles%\Download Master\is-SD330.tmp to %ProgramFiles%\Download Master\unins000.exe
- from %ProgramFiles%\Download Master\Sounds\is-O3QHB.tmp to %ProgramFiles%\Download Master\Sounds\done.wav
- from %ProgramFiles%\Download Master\Sounds\is-HUDKN.tmp to %ProgramFiles%\Download Master\Sounds\error.wav
- from %ProgramFiles%\Download Master\Plugins\is-0EL5Q.tmp to %ProgramFiles%\Download Master\Plugins\advscheduler.chm
- from %ProgramFiles%\Download Master\Plugins\is-O0ASG.tmp to %ProgramFiles%\Download Master\Plugins\advscheduler.dll
- from %ProgramFiles%\Download Master\Plugins\is-U4FK6.tmp to %ProgramFiles%\Download Master\Plugins\trayindicator.lng
- from %ProgramFiles%\Download Master\Plugins\is-H289Q.tmp to %ProgramFiles%\Download Master\Plugins\trayindicator.dll
- from %APPDATA%\Download Master\lists\is-9BGI9.tmp to %APPDATA%\Download Master\lists\trayindicator.ini
- from %ProgramFiles%\Download Master\is-G429T.tmp to %ProgramFiles%\Download Master\dmie.dll
- from %ProgramFiles%\Download Master\is-U7D28.tmp to %ProgramFiles%\Download Master\dmiehlp.dll
- from %ProgramFiles%\Download Master\is-QD578.tmp to %ProgramFiles%\Download Master\dmbar.dll
- from %ProgramFiles%\Download Master\is-L6HOD.tmp to %ProgramFiles%\Download Master\dmie.htm
- from %ProgramFiles%\Download Master\is-GKR7H.tmp to %ProgramFiles%\Download Master\dmieall.htm
- from %ProgramFiles%\Download Master\is-TA8HC.tmp to %ProgramFiles%\Download Master\npdm.dll
- from %APPDATA%\Download Master\is-E18PO.tmp to %APPDATA%\Download Master\nodelist.xml
- from %ProgramFiles%\Download Master\is-1F6NU.tmp to %ProgramFiles%\Download Master\nodelist.xml
- from %ProgramFiles%\Download Master\Skins\is-MNJK3.tmp to %ProgramFiles%\Download Master\Skins\Icandy.skn
- from %ProgramFiles%\Download Master\Skins\is-LSFR7.tmp to %ProgramFiles%\Download Master\Skins\JDs.skn
- from %ProgramFiles%\Download Master\Skins\is-JTG23.tmp to %ProgramFiles%\Download Master\Skins\MediaVista-B.skn
- from %ProgramFiles%\Download Master\Skins\is-VOOKJ.tmp to %ProgramFiles%\Download Master\Skins\MediaVista-B2.skn
- from %ProgramFiles%\Download Master\Skins\is-38H2C.tmp to %ProgramFiles%\Download Master\Skins\MediaVista-G.skn
- from %ProgramFiles%\Download Master\Skins\is-GLMTK.tmp to %ProgramFiles%\Download Master\Skins\MediaVista-G2.skn
- from %ProgramFiles%\Download Master\Skins\is-5DML0.tmp to %ProgramFiles%\Download Master\Skins\MediaVista-R.skn
- from %ProgramFiles%\Download Master\Skins\is-BB9M4.tmp to %ProgramFiles%\Download Master\Skins\MediaVista-R2.skn
- from %ProgramFiles%\Download Master\Skins\is-4FMP4.tmp to %ProgramFiles%\Download Master\Skins\Noia.skn
- from %ProgramFiles%\Download Master\Skins\is-AT5Q8.tmp to %ProgramFiles%\Download Master\Skins\Oskar.skn
- from %ProgramFiles%\Download Master\Sounds\is-R48KH.tmp to %ProgramFiles%\Download Master\Sounds\alldone.wav
- from %ProgramFiles%\Download Master\Skins\is-QFSR7.tmp to %ProgramFiles%\Download Master\Skins\Sky.skn
- from %ProgramFiles%\Download Master\Sounds\is-6CEN7.tmp to %ProgramFiles%\Download Master\Sounds\add.wav
- from %ProgramFiles%\Download Master\Plugins\is-U4282.tmp to %ProgramFiles%\Download Master\Plugins\videoserv.dll
- from %ProgramFiles%\Download Master\is-1VUMF.tmp to %ProgramFiles%\Download Master\bugtype.cfg
- from %ProgramFiles%\Download Master\is-TFPU2.tmp to %ProgramFiles%\Download Master\bugtype_e.cfg
- from %ProgramFiles%\Download Master\is-05038.tmp to %ProgramFiles%\Download Master\com.westbyte.downloadmaster.exe
- from %ProgramFiles%\Download Master\is-SJSPC.tmp to %ProgramFiles%\Download Master\com.westbyte.downloadmaster.ff.json
- from %ProgramFiles%\Download Master\is-KR9L9.tmp to %ProgramFiles%\Download Master\com.westbyte.downloadmaster.json
- from %ProgramFiles%\Download Master\is-U6531.tmp to %ProgramFiles%\Download Master\dmaster.dat
- from %ProgramFiles%\Download Master\is-V3TJ1.tmp to %ProgramFiles%\Download Master\dmaster.exe
- from %ProgramFiles%\Download Master\is-DHCRC.tmp to %ProgramFiles%\Download Master\dmaster1.dat
- from %ProgramFiles%\Download Master\is-NG8U8.tmp to %ProgramFiles%\Download Master\dmaster2.dat
- from %ProgramFiles%\Download Master\is-FLCB0.tmp to %ProgramFiles%\Download Master\dmaster3.dat
- from %ProgramFiles%\Download Master\is-1AO1T.tmp to %ProgramFiles%\Download Master\dmaster4.dat
- from %ProgramFiles%\Download Master\is-S008O.tmp to %ProgramFiles%\Download Master\dmaster5.dat
- from %ProgramFiles%\Download Master\is-IQLG7.tmp to %ProgramFiles%\Download Master\dm_rus.chm
- from %ProgramFiles%\Download Master\is-1V4FO.tmp to %ProgramFiles%\Download Master\goback.htm
- from %ProgramFiles%\Download Master\is-1JFGK.tmp to %ProgramFiles%\Download Master\hintf.bmp
- from %ProgramFiles%\Download Master\is-QQF59.tmp to %ProgramFiles%\Download Master\html.htm
- from %ProgramFiles%\Download Master\is-SRVTS.tmp to %ProgramFiles%\Download Master\lvcolors.cfg
- from %ProgramFiles%\Download Master\is-ILOF0.tmp to %ProgramFiles%\Download Master\other_str.txt
- from %ProgramFiles%\Download Master\is-OFIJT.tmp to %ProgramFiles%\Download Master\referers.txt
- from %ProgramFiles%\Download Master\is-K4QON.tmp to %ProgramFiles%\Download Master\typeconn.cfg
- from %ProgramFiles%\Download Master\is-D86DV.tmp to %ProgramFiles%\Download Master\unrar.dll
- from %ProgramFiles%\Download Master\is-8RNAH.tmp to %ProgramFiles%\Download Master\unzip32.dll
- from %ProgramFiles%\Download Master\Extensions\is-M54KH.tmp to %ProgramFiles%\Download Master\Extensions\dm@westbyte.com.xpi
- from %ProgramFiles%\Download Master\Extensions\is-GUBEP.tmp to %ProgramFiles%\Download Master\Extensions\dmbarff@westbyte.com.xpi
- from %ProgramFiles%\Download Master\Extensions\is-0VAR9.tmp to %ProgramFiles%\Download Master\Extensions\dmpluginff@westbyte.com.xpi
- from %ProgramFiles%\Download Master\Skins\is-TH3F7.tmp to %ProgramFiles%\Download Master\Skins\Standard.skn
- from %ProgramFiles%\Download Master\Skins\is-GTJ8A.tmp to %ProgramFiles%\Download Master\Skins\Vista Inspirat.skn
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\dmaster.exe' /VERYSILENT /NORESTART /LOADINF="dmaster.ini"
- '%TEMP%\is-5SRLH.tmp\dmaster.tmp' /SL5="$50092,7473066,67072,%TEMP%\RarSFX0\dmaster.exe" /VERYSILENT /NORESTART /LOADINF="dmaster.ini"
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Download Master\dmie.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Download Master\dmiehlp.dll"
- '%WINDIR%\regedit.exe' /S "%TEMP%\RarSFX0\settings.reg"
