File name:

idm.6.41.2_patch.2.6.zip

Full analysis: https://app.any.run/tasks/f9d4cdc0-133b-4e8b-a628-f47980356cd1
Verdict: Malicious activity
Analysis date: July 31, 2022, 18:30:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

DA5DE1243E53F01B407CF8710411446A

SHA1:

010A644BB0CC64CF3F57208D3E4E1BE11BCEB3AF

SHA256:

BC5E6B673ED24B2DE6F8ED79F721E5428E70753E86281AD348DBAFD396311399

SSDEEP:

196608:twF/7LibdsTinLl+wwGnLOoypzxriOGF5Dv7biifP0x37B3hc51YfBLz605p9ylf:uxKJLYNXo/1xblI7n+4B35pscW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3224)
      • WinRAR.exe (PID: 2716)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • 7za.exe (PID: 3032)

    • Application was dropped or rewritten from another process

      • IDM 6.xx Patcher v2.6.exe (PID: 572)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • 7za.exe (PID: 3000)
      • 7za.exe (PID: 2992)
      • AB2EF.exe (PID: 3428)
      • 7za.exe (PID: 3032)
      • AB2EF.exe (PID: 2556)
      • AB2EF.exe (PID: 2448)
      • idman641build2.exe (PID: 2612)
      • idman641build2.exe (PID: 3316)
      • AB2EF.exe (PID: 3648)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3224)
      • WinRAR.exe (PID: 2716)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • 7za.exe (PID: 3032)

    • Reads the computer name

      • WinRAR.exe (PID: 3224)
      • WinRAR.exe (PID: 2716)
      • 7za.exe (PID: 2992)
      • 7za.exe (PID: 3000)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • 7za.exe (PID: 3032)

    • Checks supported languages

      • WinRAR.exe (PID: 3224)
      • WinRAR.exe (PID: 2716)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • cmd.exe (PID: 3908)
      • 7za.exe (PID: 2992)
      • cmd.exe (PID: 2276)
      • 7za.exe (PID: 3000)
      • cmd.exe (PID: 3516)
      • AB2EF.exe (PID: 2556)
      • AB2EF.exe (PID: 3428)
      • AB2EF.exe (PID: 3648)
      • mode.com (PID: 1856)
      • 7za.exe (PID: 3032)
      • AB2EF.exe (PID: 2448)
      • idman641build2.exe (PID: 3316)
      • IDM1.tmp (PID: 3720)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3224)
      • WinRAR.exe (PID: 2716)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • 7za.exe (PID: 3032)

    • Starts application with an unusual extension

      • idman641build2.exe (PID: 3316)

    • Creates a directory in Program Files

      • IDM1.tmp (PID: 3720)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 2716)
      • IDM 6.xx Patcher v2.6.exe (PID: 572)
      • IDM 6.xx Patcher v2.6.exe (PID: 2520)
      • idman641build2.exe (PID: 2612)
      • idman641build2.exe (PID: 3316)

    • Checks supported languages

      • attrib.exe (PID: 2860)
      • reg.exe (PID: 1816)
      • find.exe (PID: 2904)
      • reg.exe (PID: 3576)
      • find.exe (PID: 3412)
      • reg.exe (PID: 2120)
      • find.exe (PID: 3444)

    • Reads CPU info

      • reg.exe (PID: 2120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: IDM 6.xx Patcher v2.6.zip
ZipUncompressedSize: 873344
ZipCompressedSize: 873344
ZipCRC: 0x92a42f20
ZipModifyDate: 2022:05:26 22:15:24
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
25
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe winrar.exe idm 6.xx patcher v2.6.exe no specs idm 6.xx patcher v2.6.exe cmd.exe no specs attrib.exe no specs 7za.exe no specs 7za.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs mode.com no specs find.exe no specs reg.exe no specs 7za.exe find.exe no specs ab2ef.exe no specs ab2ef.exe no specs ab2ef.exe no specs ab2ef.exe no specs idman641build2.exe no specs idman641build2.exe idm1.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
572"C:\Users\admin\Desktop\IDM 6.xx Patcher v2.6.exe" C:\Users\admin\Desktop\IDM 6.xx Patcher v2.6.exe—Explorer.EXE
User:
admin
Company:
CrackingCity.com
Integrity Level:
MEDIUM
Description:
IDM 6.xx Patcher
Exit code:
3221226540
Version:
2.6.0.0
Modules
Images
c:\users\admin\desktop\idm 6.xx patcher v2.6.exe
c:\windows\system32\ntdll.dll
1816REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1856MODE CON: COLS=98 LINES=22C:\Windows\system32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
2120REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0" C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2276C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\ytmp\IDM0.bat" "C:\Windows\system32\cmd.exe—IDM 6.xx Patcher v2.6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2448AB2EF kF5nJ4D92hfOpc8C:\Users\admin\AppData\Local\Temp\ytmp\AB2EF.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ytmp\ab2ef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
2520"C:\Users\admin\Desktop\IDM 6.xx Patcher v2.6.exe" C:\Users\admin\Desktop\IDM 6.xx Patcher v2.6.exe
Explorer.EXE
User:
admin
Company:
CrackingCity.com
Integrity Level:
HIGH
Description:
IDM 6.xx Patcher
Exit code:
0
Version:
2.6.0.0
Modules
Images
c:\users\admin\desktop\idm 6.xx patcher v2.6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2556AB2EF j6NM4Cxfv3C:\Users\admin\AppData\Local\Temp\ytmp\AB2EF.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ytmp\ab2ef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
2612"C:\Users\admin\Desktop\idman641build2.exe" C:\Users\admin\Desktop\idman641build2.exe—Explorer.EXE
User:
admin
Company:
Tonec Inc.
Integrity Level:
MEDIUM
Description:
Internet Download Manager installer
Exit code:
3221226540
Version:
6, 41, 2, 1
Modules
Images
c:\users\admin\desktop\idman641build2.exe
c:\windows\system32\ntdll.dll
2716"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\IDM 6.xx Patcher v2.6.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 825
Read events
2 791
Write events
34
Delete events
0

Modification events

(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3224) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\idm.6.41.2_patch.2.6.zip
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
2
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
3224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3224.37959\IDM 6.xx Patcher v2.6.zipcompressed
MD5:1D299D0050E94395418EF8800979F1CE
SHA256:E35E9E4B56237384D51852B2A2EFD959A0B8EE3594843A678D87732438DF013A
3224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3224.37959\www.crackingcity.com - Free full version software.urlurl
MD5:075E86F12563B1EA5A6E307F1A0FBF3B
SHA256:4DE29B8987250D20BDD095148E21E504493E0E2A160D4106AE97EED1E5F92175
2716WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2716.38593\IDM 6.xx Patcher v2.6.exeexecutable
MD5:1F0C79DBE6A9F5E1E37F776D3C0A48B6
SHA256:8FE50399830E5677336E1F78D0BFAD2975DC3704829F87AB3EDE61D34DE121A3
2520IDM 6.xx Patcher v2.6.exeC:\Users\admin\AppData\Local\Temp\ytmp\files.tmpcompressed
MD5:C09646616B34D4FEB30D9BA1C7F4DF8B
SHA256:3072BCA758AEFEB6ED4FDDF0318273E1BC0CB5C2602698034A5C9D3ADE72E2C0
2520IDM 6.xx Patcher v2.6.exeC:\Users\admin\AppData\Local\Temp\ytmp\main.battext
MD5:320CD6EE614494CAE88E658960B2EA1F
SHA256:B36A223C84CF73FF7C9BE4674B2CED71A1EE5E2724218BAF00D4611A184F221F
30007za.exeC:\Users\admin\AppData\Local\Temp\ytmp\IDM.battext
MD5:F371027A4223005CF3AA73A0F3FE8C04
SHA256:49BFA64A09EE9F26EB1A5EC593F4A1DC04AC58027382F021B398E969F70F37EF
30327za.exeC:\Users\admin\AppData\Local\Temp\ytmp\AB2EF.exeexecutable
MD5:8CF23FA804804EB416F7F395D5F0647F
SHA256:C69B39AD2739DAB03DBEE316BB9B921883AA8880A4E4E9BDDE7723E75A178B21
3224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3224.37959\idman641build2.exeexecutable
MD5:8451D5F02C795901410E2E6C832CD8C8
SHA256:025EAC1FAD5CDB0442BFF25B2BCC80E28F28AC97910DD88F5B750FC06DC4B29E
2520IDM 6.xx Patcher v2.6.exeC:\Users\admin\AppData\Local\Temp\ytmp\7za.exeexecutable
MD5:E3C061FA0450056E30285FD44A74CD2A
SHA256:E0E2C7D0F740FE2A4E8658CE54DFB6EB3C47C37FE90A44A839E560C685F1F1FA
29927za.exeC:\Users\admin\AppData\Local\Temp\ytmp\IDM0.battext
MD5:69C3EDFE8C7003F905F19969922D2626
SHA256:D90A40FCEF70925252CAF6722C29E95C4B904A19771E6E60AB39F00B161B8464
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
idm.6.41.2_patch.2.6.zip