EchoTrail

Internet Download Manager 6.43.18

by Tonec Inc.installer signed by Tonec Inc.Valid

Sources: observed in the EchoTrail lab on Windows 11 on November 10, 2026.

The install

Installer
idman643build18.exe
Installed through
the window clicker
Install directory
C:\Program Files (x86)\Internet Download Manager
Launched
IDMan.exe
Windows
Windows 11
Date
November 10, 2026
Executables dropped
49

installer sha256 7346128fab42957b4254eabdb012bfdbd751e9069361e98a6916f26bb03d62ee

The lab used Internet Download Manager for 1 minute, changed a setting, ran its update check, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Internet Download Manager's own windows.

Internet Download Manager 6.43.18: First window
First window. A Tip of the Day dialog is shown over the Internet Download Manager main window.
Internet Download Manager 6.43.18: Main window
Main window. The IDM main window is open with an empty download list and a Windows Security notification about the firewall in the corner.
Internet Download Manager 6.43.18: Settings
Settings. The IDM Configuration dialog is open on the General tab, showing browser integration options and a startup checkbox.
Internet Download Manager 6.43.18: Worth a look
Worth a look. IDM browser integration dialog says the extension was installed into Edge, over a Tip of the Day dialog.
Internet Download Manager 6.43.18: Worth a look
Worth a look. A Quick Update dialog says IDM is the latest version, and a Windows Security threats-found notification is visible at bottom right.

What it dropped

Executables

  • idman.exesigned by CN=Tonec Inc., OU=Internet Download Manager, O=Tonec Inc., L=New York, S=New York, C=USValidran during the lab session
    C:\Program Files (x86)\Internet Download Manager\IDMan.exe
    sha256 a705c0154fafc7cd509decf165cb6f6c050b6521b40adb6f730dd827c86051c7
  • libcrypto.dll
    C:\Program Files (x86)\Internet Download Manager\libcrypto.dll
  • idmcchandler7_64.dll
    C:\Program Files (x86)\Internet Download Manager\idmcchandler7_64.dll
  • idmiecc64.dll
    C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
  • idmnetmon64.dll
    C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
  • idmgrhlp.exesigned by CN=Tonec Inc., O=Tonec Inc., L=New York, S=New York, C=USValidran during the lab session
    C:\Program Files (x86)\Internet Download Manager\IDMGrHlp.exe
    sha256 b3b6281ea820eae8192e50b30698cf4c3b8bc3d4376c978403bc9e18e5857c23
  • idmnetmon.dll
    C:\Program Files (x86)\Internet Download Manager\IDMNetMon.dll
  • idmiecc.dll
    C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
  • idmcchandler2_64.dll
    C:\Program Files (x86)\Internet Download Manager\idmcchandler2_64.dll
    sha256 59ac02f5a0644bf56b7ad7e2b48fc8f89083f8cfe12a0a93f63163a5573a876f
  • idmcchandler2_64.dll
    C:\Users\lab\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll
    sha256 59ac02f5a0644bf56b7ad7e2b48fc8f89083f8cfe12a0a93f63163a5573a876f
  • idmindex.dll
    C:\Program Files (x86)\Internet Download Manager\idmindex.dll
  • idmvmprs64.dll
    C:\Program Files (x86)\Internet Download Manager\IDMVMPrs64.dll
  • idmcchandler7.dll
    C:\Program Files (x86)\Internet Download Manager\idmcchandler7.dll
  • iemonitor.exesigned by CN=Tonec Inc., O=Tonec Inc., L=New York, S=New York, C=USValidran during the lab session
    C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
    sha256 c8fd8860e9a05cc61684ca7a4fea22eda721e701ee717dc039f52312d8d21be6
  • libssl.dll
    C:\Program Files (x86)\Internet Download Manager\libssl.dll
  • idmvmprs.dll
    C:\Program Files (x86)\Internet Download Manager\IDMVMPrs.dll
  • idmcchandler2.dll
    C:\Program Files (x86)\Internet Download Manager\idmcchandler2.dll
    sha256 1450146b904919474ef6d528b20a672a33a32afc4a1e40f69d515b523d72fa19
  • idmcchandler2.dll
    C:\Users\lab\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll
    sha256 1450146b904919474ef6d528b20a672a33a32afc4a1e40f69d515b523d72fa19
  • idmbrbtn64.dll
    C:\Program Files (x86)\Internet Download Manager\idmbrbtn64.dll
  • idmbrbtn.dll
    C:\Program Files (x86)\Internet Download Manager\idmbrbtn.dll
  • idmtdi64.sys
    C:\Program Files (x86)\Internet Download Manager\idmtdi64.sys
  • downlwithidm.dll
    C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
  • idmwfp64.sys
    C:\Program Files (x86)\Internet Download Manager\idmwfp64.sys
  • idmwfpaa.sys
    C:\Program Files (x86)\Internet Download Manager\idmwfpAA.sys
  • uninstall.exefile_missingran during the lab session
    C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
    sha256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
  • downlwithidm64.dll
    C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
  • idmwfp32.sys
    C:\Program Files (x86)\Internet Download Manager\idmwfp32.sys
  • idmbroker.exesigned by CN=Tonec Inc., O=Tonec Inc., L=New York, S=New York, C=USValidran during the lab session
    C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
    sha256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
  • idmtdi32.sys
    C:\Program Files (x86)\Internet Download Manager\idmtdi32.sys
  • idmmzcc7_64.dll
    C:\Program Files (x86)\Internet Download Manager\idmmzcc7_64.dll
  • idmgetall64.dll
    C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
  • idmfsa.dll
    C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
  • idmgetall.dll
    C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
  • mediumilstart.exesigned by CN=Tonec Inc., O=Tonec Inc., L=New York, S=New York, C=USValidran during the lab session
    C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
    sha256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
  • idmftype64.dll
    C:\Program Files (x86)\Internet Download Manager\IDMFType64.dll
  • oldjsproxy.dll
    C:\Program Files (x86)\Internet Download Manager\oldjsproxy.dll
  • idmftype.dll
    C:\Program Files (x86)\Internet Download Manager\idmftype.dll
  • idmmsghost.exesigned by CN=Tonec Inc., O=Tonec Inc., L=New York, S=New York, C=USValidran during the lab session
    C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe
    sha256 dba25a49adb88f675db26d2dc7a0fa9d4a5db2326858cb9d2515f6f34b8e0b65
  • idmshellext64.dll
    C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
  • idmshellext.dll
    C:\Program Files (x86)\Internet Download Manager\IDMShellExt.dll

Drivers

  • IDMWFP

Run keys

  • IDManC:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot

After the reboot

Started on its own

  • idman.exe started by explorer.exe

Autostart entries

  • run key: IDManC:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
  • service: MicrosoftCopilotElevationService"C:\Program Files (x86)\Microsoft\Copilot\Application\157.0.4341.42\elevation_service.exe"

What it talked to

Destinations

  • 67.18.60.145:443asked by idman.exe3 connections

DNS

  • mirror3.internetdownloadmanager.comasked by idman.exe
  • mirror5.internetdownloadmanager.comasked by idman.exe
  • registeridm.comasked by idman.exe
  • secure.internetdownloadmanager.comasked by idman.exe
  • test.internetdownloadmanager.comasked by idman.exe
  • www.internetdownloadmanager.comasked by idman.exe