Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /F /IM IDMan.exe
- '<SYSTEM32>\taskkill.exe' /F /IM IDMGrHlp.exe
Modifies file system:
Creates the following files:
- %TEMP%\1.tmp\2.bat
- %TEMP%\1.tmp\Tool\Koushik_Halder_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder.tbi
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder_Large_Disable.bmp
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder_Small_Disable.bmp
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Koushik_tb\Koushik_Halder_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\LS_largeHot_3.bmp
- %TEMP%\1.tmp\Tool\LS_large_3.bmp
- %TEMP%\1.tmp\Tool\LS_style_2.tbi
- %TEMP%\1.tmp\Tool\Mac\Mac.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Light\Helvet_3D_Light-Large_Disabled.bmp
- %TEMP%\1.tmp\Tool\Mac\MacHot.bmp
- %TEMP%\1.tmp\Tool\Metro\Metro-IDM.bmp
- %TEMP%\1.tmp\Tool\Metro\Metro-IDMHot.bmp
- %TEMP%\1.tmp\Tool\Metro.tbi
- %TEMP%\1.tmp\Tool\MosI3D_1.tbi
- %TEMP%\1.tmp\Tool\MosI3D_largeHot_1.bmp
- %TEMP%\1.tmp\Tool\MosI3D_large_1.bmp
- %TEMP%\1.tmp\Tool\MosI3D_smallHot_1.bmp
- %TEMP%\1.tmp\Tool\MosI3D_small_1.bmp
- %TEMP%\1.tmp\Tool\Mosi_Modern_XP.bmp
- %TEMP%\1.tmp\Tool\Mosi_Modern_XP.tbi
- %TEMP%\1.tmp\Tool\Mosi_Modern_XPHot.bmp
- %TEMP%\1.tmp\Tool\Primo.tbi
- %TEMP%\1.tmp\Tool\Koushik_Halder_Small_Disable.bmp
- %TEMP%\1.tmp\Tool\Koushik_Halder_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Koushik_Halder_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Koushik_Halder_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Koushik_Halder_Large_Disable.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Color\Helvet_3D_Color-Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Color\Helvet_3D_Color-Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Color\Helvet_3D_Color-Small_Disabled.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Color\Helvet_3D_Color-Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Color\Helvet_3D_Color-Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Color.tbi
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark\Helvet_3D_Dark-Large_Disabled.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark\Helvet_3D_Dark-Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark\Helvet_3D_Dark-Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark\Helvet_3D_Dark-Small_Disabled.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark\Helvet_3D_Dark-Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark\Helvet_3D_Dark-Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Primo_hot.bmp
- %TEMP%\1.tmp\Tool\Mac.tbi
- %TEMP%\1.tmp\Tool\Helvet_3D_Dark.tbi
- %TEMP%\1.tmp\Tool\Helvet_3D_Light\Helvet_3D_Light-Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Light\Helvet_3D_Light-Small_Disabled.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Light\Helvet_3D_Light-Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Light\Helvet_3D_Light-Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Light.tbi
- %TEMP%\1.tmp\Tool\ios7.bmp
- %TEMP%\1.tmp\Tool\ios7.tbi
- %TEMP%\1.tmp\Tool\ios7_hot.bmp
- %TEMP%\1.tmp\Tool\Kavian\Kavian_Larg.bmp
- %TEMP%\1.tmp\Tool\Kavian\Kavian_Larg_Hot.bmp
- %TEMP%\1.tmp\Tool\Kavian.tbi
- %TEMP%\1.tmp\Tool\Koushik Halder.tbi
- %TEMP%\1.tmp\Tool\Helvet_3D_Color\Helvet_3D_Color-Large_Disabled.bmp
- %TEMP%\1.tmp\Tool\Helvet_3D_Light\Helvet_3D_Light-Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\211.bmp
- %TEMP%\1.tmp\Tool\Windows8.tbi
- %TEMP%\1.tmp\Tool\PT LIGHT\PT_LN.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\251.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\252.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\311.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\315.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\317.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\323.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\325.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\Pure_Flat_2013-Large_Disabled.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\Pure_Flat_2013-Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\Pure_Flat_2013-Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\Pure_Flat_2013-Small_Disabled.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\Pure_Flat_2013-Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Primo_normal.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\Pure_Flat_2013-Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013.tbi
- %TEMP%\1.tmp\Tool\round.bmp
- %TEMP%\1.tmp\Tool\round.tbi
- %TEMP%\1.tmp\Tool\roundHot.bmp
- %TEMP%\1.tmp\Tool\ThL-Toolbar.tbi
- %TEMP%\1.tmp\Tool\ThL-Toolbar_bmps\ThL-Hot.bmp
- %TEMP%\1.tmp\Tool\ThL-Toolbar_bmps\ThL-Normal.bmp
- %TEMP%\1.tmp\Tool\Windows 8.bmp
- %TEMP%\1.tmp\Tool\Windows 8_hot.bmp
- %TEMP%\1.tmp\Tool\Windows10.bmp
- %TEMP%\1.tmp\Tool\Windows10.tbi
- %TEMP%\1.tmp\Tool\Windows7.tbi
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\249.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\250.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\248.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\247.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\225.bmp
- %TEMP%\1.tmp\Tool\PT LIGHT\PT_SN.bmp
- %TEMP%\1.tmp\Tool\PT Light.tbi
- %TEMP%\1.tmp\Tool\PureFlat\PureFlat_Larg.bmp
- %TEMP%\1.tmp\Tool\PureFlat\PureFlat_Larg_Hot.bmp
- %TEMP%\1.tmp\Tool\PureFlat\PureFlat_Small.bmp
- %TEMP%\1.tmp\Tool\PureFlat\PureFlat_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\PureFlat.tbi
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\199.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\200.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\201.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\202.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\203.bmp
- %TEMP%\1.tmp\Tool\PT LIGHT\PT_LH.bmp
- %TEMP%\1.tmp\Tool\H3M_Painted_Stickers_Toolbar\H3M_PS_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\210.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\213.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\214.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\215.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\216.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\217.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\218.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\219.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\220.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\221.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\222.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\223.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\224.bmp
- %TEMP%\1.tmp\Tool\PT LIGHT\PT_SH.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\BITMAP\212.bmp
- %TEMP%\1.tmp\Tool\Pure_Flat_2013\readme!.txt
- %TEMP%\1.tmp\Tool\H3M_Painted_Stickers_Toolbar\H3M_PS_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Cubic3D_Toolbar\H3M_Cubic3D_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\201.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\202.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\203.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\210.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\211.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\212.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\213.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\214.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\215.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\216.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\217.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\218.bmp
- %TEMP%\1.tmp\Tool\7_IDM\7-IDM.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\219.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\221.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\222.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\223.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\224.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\225.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\247.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\248.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\249.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\250.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\251.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\252.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\311.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\199.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\200.bmp
- %TEMP%\1.tmp\Tool\Blue_Arrow_Normal.bmp
- %TEMP%\1.tmp\Tool\Blue_Arrow_Mini_Normal.bmp
- %TEMP%\1.tmp\Tool\Blue_Arrow_Mini_Hot.bmp
- %TEMP%\1.tmp\Cleanup.cmd
- %TEMP%\1.tmp\idman630build9f.exe
- %TEMP%\1.tmp\Backup\IDM Backup Manager\7-zip32.dll
- %TEMP%\1.tmp\Backup\IDM Backup Manager\Help.chm
- %TEMP%\1.tmp\Backup\IDM Backup Manager\IDM Backup Manager.exe
- %TEMP%\1.tmp\Crack\IDMan.exe
- %TEMP%\1.tmp\Tool\3d_largeHot_3.bmp
- %TEMP%\1.tmp\Tool\3d_largeHot_3_hdpi15.bmp
- %TEMP%\1.tmp\Tool\3d_large_3.bmp
- %TEMP%\1.tmp\Tool\3d_large_3_hdpi15.bmp
- %TEMP%\1.tmp\Tool\3d_smallHot_3.bmp
- %TEMP%\1.tmp\Tool\3d_small_3.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\315.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\220.bmp
- %TEMP%\1.tmp\Tool\3d_style_3.tbi
- %TEMP%\1.tmp\Tool\BilsOrbit\BilsOrbit_LH.bmp
- %TEMP%\1.tmp\Tool\BilsOrbit\BilsOrbit_LN.bmp
- %TEMP%\1.tmp\Tool\BilsOrbit\BilsOrbit_SH.bmp
- %TEMP%\1.tmp\Tool\BilsOrbit\BilsOrbit_SN.bmp
- %TEMP%\1.tmp\Tool\BilsOrbit.tbi
- %TEMP%\1.tmp\Tool\black-Over.bmp
- %TEMP%\1.tmp\Tool\black.bmp
- %TEMP%\1.tmp\Tool\black.tbi
- %TEMP%\1.tmp\Tool\Blue_Arrow.tbi
- %TEMP%\1.tmp\Tool\Blue_Arrow_Disable.bmp
- %TEMP%\1.tmp\Tool\Blue_Arrow_Hot.bmp
- %TEMP%\1.tmp\Tool\Blue_Arrow_Mini_Disable.bmp
- %TEMP%\1.tmp\password_IDM.reg
- %TEMP%\1.tmp\Tool\7_IDM\7-IDMHot.bmp
- %TEMP%\1.tmp\Tool\gant3_small_hot_3_pkuwyc.bmp
- %TEMP%\1.tmp\Tool\H3M_Painted_Stickers_Toolbar\H3M_PS_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\325.bmp
- %TEMP%\1.tmp\Tool\H3M_Bronze_Shapes.tbi
- %TEMP%\1.tmp\Tool\H3M_Bronze_Shapes_Toolbar\H3M_BS_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Bronze_Shapes_Toolbar\H3M_BS_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Bronze_Shapes_Toolbar\H3M_BS_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Bronze_Shapes_Toolbar\H3M_BS_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Buttons.tbi
- %TEMP%\1.tmp\Tool\H3M_Buttons_Toolbar\H3M_Buttons_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Buttons_Toolbar\H3M_Buttons_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Buttons_Toolbar\H3M_Buttons_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Buttons_Toolbar\H3M_Buttons_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Cubic3D.tbi
- %TEMP%\1.tmp\Tool\H3M_Cubic3D_Toolbar\H3M_Cubic3D_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\317.bmp
- %TEMP%\1.tmp\Tool\H3M_Cubic3D_Toolbar\H3M_Cubic3D_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Cubic3D_Toolbar\H3M_Cubic3D_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Glossy.tbi
- %TEMP%\1.tmp\Tool\H3M_Glossy_Toolbar\H3M_Glossy_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Glossy_Toolbar\H3M_Glossy_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Glossy_Toolbar\H3M_Glossy_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Glossy_Toolbar\H3M_Glossy_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Olive_Shapes.tbi
- %TEMP%\1.tmp\Tool\H3M_Olive_Shapes_Toolbar\H3M_OS_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Olive_Shapes_Toolbar\H3M_OS_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Olive_Shapes_Toolbar\H3M_OS_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_Olive_Shapes_Toolbar\H3M_OS_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_Painted_Stickers.tbi
- %TEMP%\1.tmp\Tool\H3M_BlueSky_Shapes_Toolbar\H3M_BSS_Small_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_BlueSky_Shapes_Toolbar\H3M_toolbars.zip
- %TEMP%\1.tmp\Tool\H3M_BlueSky_Shapes_Toolbar\H3M_BSS_Small_Hot.bmp
- %TEMP%\1.tmp\Tool\H3M_BlueSky_Shapes_Toolbar\H3M_BSS_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\H3M_BlueSky_Shapes_Toolbar\H3M_BSS_Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\Dtu_Style-Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\Dtu_Style-Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\Dtu_Style-Small_Disabled.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\Dtu_Style-Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\Dtu_Style-Small_Normal.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\readme!.txt
- %TEMP%\1.tmp\Tool\Dtu_Style.tbi
- %TEMP%\1.tmp\Tool\Flat2015-Over.bmp
- %TEMP%\1.tmp\Tool\Flat2015.bmp
- %TEMP%\1.tmp\Tool\Flat2015.tbi
- %TEMP%\1.tmp\Tool\gant3_large_3_pkuwyc.bmp
- %TEMP%\1.tmp\Tool\gant3_large_hot_3_pkuwyc.bmp
- %TEMP%\1.tmp\Tool\Dtu_Style\BITMAP\323.bmp
- %TEMP%\1.tmp\Tool\H3M_Painted_Stickers_Toolbar\H3M_PS_Large_Normal.bmp
- %TEMP%\1.tmp\Tool\gant3_small_3_pkuwyc.bmp
- %TEMP%\1.tmp\Tool\GD.bmp
- %TEMP%\1.tmp\Tool\GH.bmp
- %TEMP%\1.tmp\Tool\GL.bmp
- %TEMP%\1.tmp\Tool\Glyfz 2016.tbi
- %TEMP%\1.tmp\Tool\Glyfz_2016\Glyfz_2016-Large_Disabled.bmp
- %TEMP%\1.tmp\Tool\Glyfz_2016\Glyfz_2016-Large_Hot.bmp
- %TEMP%\1.tmp\Tool\Glyfz_2016\Glyfz_2016-Large_Normal.bmp
- %TEMP%\1.tmp\Tool\Glyfz_2016\Glyfz_2016-Small_Disabled.bmp
- %TEMP%\1.tmp\Tool\Glyfz_2016\Glyfz_2016-Small_Hot.bmp
- %TEMP%\1.tmp\Tool\Glyfz_2016\Glyfz_2016-Small_Normal.bmp
- %TEMP%\1.tmp\Tool\GUiMAGiNATION.tbi
- %TEMP%\1.tmp\Tool\H3M_BlueSky_Shapes.tbi
- %TEMP%\1.tmp\Tool\Dtu_Style\Dtu_Style-Large_Disabled.bmp
- %TEMP%\1.tmp\Tool\gant3_style_by_pkuwyc_3.tbi
- %TEMP%\1.tmp\permdel.txt
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
- '<SYSTEM32>\cmd.exe' /K Cleanup.cmd
- '<SYSTEM32>\regini.exe' permdel.txt
