idmtdi.sys
Internet Download Manager TDI Driver file version info
Driver on Windows LOLDrivers malicious
A known malicious driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/5fb86651-c152-404a-9a2f-0f54b0d2bb55/
https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/
https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/
8 known samples
6.32.3.80 · its entry
2c1b65c2988b337182f1ba57b404793454e30a7fd328d34bc2e79857dc437a4a6.32.3.80 · its entry
44ebb0f534e7cdfec06d5234358d219798a313219b214d72aa23afc5a57d7ea96.32.3.80 · its entry
77225a99b2e0e2b4007fb2f5a96d356e13deab45b9ef54c175d5452de8a211a708c4b75a9b715647a60b946f3743c4e49a6f5c36c1bc889e741d658508dc50c03855b2df32e0eedec454b25e6e2da6b3df19c4b0f575e45bc06482d4ebce75514421ff85aacbcc36695a018c5c47e884d56d62d7d5b8172bb70384ffc4d6a2e47af2ff5d405cf9cd1aee2410a969ba22d6df78d98e9d4e60cbe624d8a3bc64a6ce106afd6a9996ac0150709a30d61ece7d7bfe1f27492c00f4fabab9ec40575dFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real idmtdi.sys?
ProductInternet Download Manager, Tonec Inc.
DescriptionInternet Download Manager TDI Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.