Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\internet download manager auto update scheduler
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im "idmupd.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-t5scv.tmp\<Имя файла>.tmp
- %TEMP%\idm_setup_temp\idm93.tmp
- %TEMP%\idm_setup_temp\idm94.tmp
- %TEMP%\idm_setup_temp\idm95.tmp
- %TEMP%\idm_setup_temp\idm96.tmp
- %TEMP%\idm_setup_temp\idm97.tmp
- %TEMP%\idm_setup_temp\idm98.tmp
- %TEMP%\idm_setup_temp\idm99.tmp
- %TEMP%\idm_setup_temp\idm101.tmp
- %TEMP%\idm_setup_temp\idm109.tmp
- %TEMP%\idm_setup_temp\idm102.tmp
- %TEMP%\idm_setup_temp\idm103.tmp
- %TEMP%\idm_setup_temp\idm104.tmp
- %TEMP%\idm_setup_temp\idm105.tmp
- %TEMP%\idm_setup_temp\idm106.tmp
- %TEMP%\idm_setup_temp\idm107.tmp
- %TEMP%\idm_setup_temp\idm108.tmp
- %TEMP%\idm_setup_temp\idm92.tmp
- %TEMP%\idm_setup_temp\idm100.tmp
- %TEMP%\idm_setup_temp\idm91.tmp
- %TEMP%\idm_setup_temp\idm80.tmp
- %TEMP%\idm_setup_temp\idm73.tmp
- %TEMP%\idm_setup_temp\idm74.tmp
- %TEMP%\idm_setup_temp\idm75.tmp
- %TEMP%\idm_setup_temp\idm76.tmp
- %TEMP%\idm_setup_temp\idm77.tmp
- %TEMP%\idm_setup_temp\idm78.tmp
- %TEMP%\idm_setup_temp\idm79.tmp
- %TEMP%\idm_setup_temp\idm81.tmp
- %TEMP%\idm_setup_temp\idm89.tmp
- %TEMP%\idm_setup_temp\idm82.tmp
- %TEMP%\idm_setup_temp\idm83.tmp
- %TEMP%\idm_setup_temp\idm84.tmp
- %TEMP%\idm_setup_temp\idm85.tmp
- %TEMP%\idm_setup_temp\idm86.tmp
- %TEMP%\idm_setup_temp\idm87.tmp
- %TEMP%\idm_setup_temp\idm88.tmp
- %TEMP%\idm_setup_temp\idm90.tmp
- %TEMP%\idm_setup_temp\idm121.tmp
- %TEMP%\idm_setup_temp\idm149.tmp
- %TEMP%\idm_setup_temp\idm112.tmp
- %TEMP%\idm_setup_temp\idm133.tmp
- %TEMP%\idm_setup_temp\idm134.tmp
- %TEMP%\idm_setup_temp\idm135.tmp
- %TEMP%\idm_setup_temp\idm136.tmp
- %TEMP%\idm_setup_temp\idm137.tmp
- %TEMP%\idm_setup_temp\idm138.tmp
- %TEMP%\idm_setup_temp\idm139.tmp
- %TEMP%\idm_setup_temp\idm141.tmp
- %TEMP%\idm_setup_temp\idm111.tmp
- %TEMP%\idm_setup_temp\idm142.tmp
- %TEMP%\idm_setup_temp\idm143.tmp
- %TEMP%\idm_setup_temp\idm144.tmp
- %TEMP%\idm_setup_temp\idm145.tmp
- %TEMP%\idm_setup_temp\idm146.tmp
- %TEMP%\idm_setup_temp\idm147.tmp
- %TEMP%\idm_setup_temp\idm148.tmp
- %TEMP%\idm_setup_temp\idm132.tmp
- %TEMP%\idm_setup_temp\idm72.tmp
- %TEMP%\idm_setup_temp\idm131.tmp
- %TEMP%\idm_setup_temp\idm120.tmp
- %TEMP%\idm_setup_temp\idm113.tmp
- %TEMP%\idm_setup_temp\idm114.tmp
- %TEMP%\idm_setup_temp\idm115.tmp
- %TEMP%\idm_setup_temp\idm116.tmp
- %TEMP%\idm_setup_temp\idm117.tmp
- %TEMP%\idm_setup_temp\idm118.tmp
- %TEMP%\idm_setup_temp\idm119.tmp
- %TEMP%\idm_setup_temp\idm110.tmp
- %TEMP%\idm_setup_temp\idm129.tmp
- %TEMP%\idm_setup_temp\idm122.tmp
- %TEMP%\idm_setup_temp\idm123.tmp
- %TEMP%\idm_setup_temp\idm124.tmp
- %TEMP%\idm_setup_temp\idm125.tmp
- %TEMP%\idm_setup_temp\idm126.tmp
- %TEMP%\idm_setup_temp\idm127.tmp
- %TEMP%\idm_setup_temp\idm128.tmp
- %TEMP%\idm_setup_temp\idm130.tmp
- %TEMP%\idm_setup_temp\idm140.tmp
- %TEMP%\idm_setup_temp\idm71.tmp
- %TEMP%\idm_setup_temp\idm60.tmp
- %TEMP%\idm_setup_temp\idm13.tmp
- %TEMP%\idm_setup_temp\idm14.tmp
- %TEMP%\idm_setup_temp\idm15.tmp
- %TEMP%\idm_setup_temp\idm16.tmp
- %TEMP%\idm_setup_temp\idm17.tmp
- %TEMP%\idm_setup_temp\idm18.tmp
- %TEMP%\idm_setup_temp\idm19.tmp
- %TEMP%\idm_setup_temp\idm21.tmp
- %TEMP%\idm_setup_temp\idm29.tmp
- %TEMP%\idm_setup_temp\idm22.tmp
- %TEMP%\idm_setup_temp\idm23.tmp
- %TEMP%\idm_setup_temp\idm24.tmp
- %TEMP%\idm_setup_temp\idm25.tmp
- %TEMP%\idm_setup_temp\idm26.tmp
- %TEMP%\idm_setup_temp\idm27.tmp
- %TEMP%\idm_setup_temp\idm28.tmp
- %TEMP%\idm_setup_temp\idm12.tmp
- %TEMP%\idm_setup_temp\idm20.tmp
- %TEMP%\idm_setup_temp\idm11.tmp
- %TEMP%\idm_setup_temp\idm0.tmp
- %TEMP%\is-4pouv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4pouv.tmp\idp.dll
- %TEMP%\is-b8fgq.tmp\<Имя файла>.tmp
- %TEMP%\is-s80l6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s80l6.tmp\idp.dll
- %CommonProgramFiles(x86)%\internet download manager\update\is-3oc5b.tmp
- %TEMP%\is-s80l6.tmp\is-0mtcf.tmp
- %TEMP%\idm_setup_temp\idm1.tmp
- %TEMP%\idm_setup_temp\idm9.tmp
- %TEMP%\idm_setup_temp\idm2.tmp
- %TEMP%\idm_setup_temp\idm3.tmp
- %TEMP%\idm_setup_temp\idm4.tmp
- %TEMP%\idm_setup_temp\idm5.tmp
- %TEMP%\idm_setup_temp\idm6.tmp
- %TEMP%\idm_setup_temp\idm7.tmp
- %TEMP%\idm_setup_temp\idm8.tmp
- %TEMP%\idm_setup_temp\idm10.tmp
- %TEMP%\idm_setup_temp\idm41.tmp
- %TEMP%\idm_setup_temp\idm69.tmp
- %TEMP%\idm_setup_temp\idm32.tmp
- %TEMP%\idm_setup_temp\idm53.tmp
- %TEMP%\idm_setup_temp\idm54.tmp
- %TEMP%\idm_setup_temp\idm55.tmp
- %TEMP%\idm_setup_temp\idm56.tmp
- %TEMP%\idm_setup_temp\idm57.tmp
- %TEMP%\idm_setup_temp\idm58.tmp
- %TEMP%\idm_setup_temp\idm59.tmp
- %TEMP%\idm_setup_temp\idm61.tmp
- %TEMP%\idm_setup_temp\idm31.tmp
- %TEMP%\idm_setup_temp\idm62.tmp
- %TEMP%\idm_setup_temp\idm63.tmp
- %TEMP%\idm_setup_temp\idm64.tmp
- %TEMP%\idm_setup_temp\idm65.tmp
- %TEMP%\idm_setup_temp\idm66.tmp
- %TEMP%\idm_setup_temp\idm67.tmp
- %TEMP%\idm_setup_temp\idm68.tmp
- %TEMP%\idm_setup_temp\idm52.tmp
- %TEMP%\idm_setup_temp\idm70.tmp
- %TEMP%\idm_setup_temp\idm51.tmp
- %TEMP%\idm_setup_temp\idm40.tmp
- %TEMP%\idm_setup_temp\idm33.tmp
- %TEMP%\idm_setup_temp\idm34.tmp
- %TEMP%\idm_setup_temp\idm35.tmp
- %TEMP%\idm_setup_temp\idm36.tmp
- %TEMP%\idm_setup_temp\idm37.tmp
- %TEMP%\idm_setup_temp\idm38.tmp
- %TEMP%\idm_setup_temp\idm39.tmp
- %TEMP%\idm_setup_temp\idm30.tmp
- %TEMP%\idm_setup_temp\idm49.tmp
- %TEMP%\idm_setup_temp\idm42.tmp
- %TEMP%\idm_setup_temp\idm43.tmp
- %TEMP%\idm_setup_temp\idm44.tmp
- %TEMP%\idm_setup_temp\idm45.tmp
- %TEMP%\idm_setup_temp\idm46.tmp
- %TEMP%\idm_setup_temp\idm47.tmp
- %TEMP%\idm_setup_temp\idm48.tmp
- %TEMP%\idm_setup_temp\idm50.tmp
- %TEMP%\idm_setup_temp\idm150.tmp
Удаляет следующие файлы
- %TEMP%\is-4pouv.tmp\idp.dll
- %TEMP%\is-4pouv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-t5scv.tmp\<Имя файла>.tmp
- %TEMP%\is-s80l6.tmp\_setup.exe
- %TEMP%\is-s80l6.tmp\idp.dll
- %TEMP%\is-s80l6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-b8fgq.tmp\<Имя файла>.tmp
Перемещает следующие файлы
- %CommonProgramFiles(x86)%\internet download manager\update\is-3oc5b.tmp в %CommonProgramFiles(x86)%\internet download manager\update\idmupd.exe
- %TEMP%\is-s80l6.tmp\is-0mtcf.tmp в %TEMP%\is-s80l6.tmp\_setup.exe
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-t5scv.tmp\<Имя файла>.tmp' /SL5="$60248,8912635,122880,<Полный путь к файлу>"
- '%TEMP%\is-b8fgq.tmp\<Имя файла>.tmp' /SL5="$80242,8912635,122880,<Полный путь к файлу>" /VERYSILENT
- '%TEMP%\idm_setup_temp\idm1.tmp' -d "%TEMP%\IDM_Setup_Temp\"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "idmupd.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "Internet Download Manager Auto Update Scheduler" /TR "\"%CommonProgramFiles(x86)%\Internet Download Manager\Update\idmupd.exe\"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "Internet Download Manager Auto Update Scheduler" /TR "\"%CommonProgramFiles(x86)%\Internet Download Manager\Update\idmupd.exe\"
