Trojan.DownLoader33.31167

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\KMPlayer.ksf\shell\open\command] '' = '"%APPDATA%\KMPlayer.exe" "%1"'
[<HKLM>\Software\Classes\KMPlayer.kpl\shell\open\command] '' = '"%APPDATA%\KMPlayer.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\autfbd2.tmp
%TEMP%\aut2d69.tmp
%APPDATA%\language\ukrainian.ini
%TEMP%\aut2e35.tmp
%APPDATA%\language\vietnam.ini
%TEMP%\aut2ea4.tmp
%APPDATA%\shader\contour.txt
%TEMP%\aut2f02.tmp
%APPDATA%\shader\deinterlace (blend).txt
%TEMP%\aut3155.tmp
%APPDATA%\shader\displaylessthan16 v1_1.txt
%TEMP%\aut31f2.tmp
%APPDATA%\shader\edgesharpen v1_1(jim ro).txt
%TEMP%\aut32ed.tmp
%TEMP%\aut2c4e.tmp
%APPDATA%\shader\edgesharpen v1_1.txt
%APPDATA%\shader\emboss.txt
%TEMP%\aut33ab.tmp
%APPDATA%\shader\invert.txt
%TEMP%\aut340a.tmp
%APPDATA%\shader\letterbox.txt
%TEMP%\aut3497.tmp
%APPDATA%\shader\procamp.txt
%TEMP%\aut3515.tmp
%APPDATA%\shader\remap_16_235.txt
%TEMP%\aut364f.tmp
%APPDATA%\shader\sharpencomplex (jim ro).txt
%TEMP%\aut36bd.tmp
%APPDATA%\shader\sharpenflou (jim ro).txt
%TEMP%\aut2cdb.tmp
%APPDATA%\language\turkish.ini
%APPDATA%\language\thai.ini
%APPDATA%\language\swedish.ini
%APPDATA%\shader\sharpen_3x3.txt
%APPDATA%\language\finnish.ini
%TEMP%\aut25b8.tmp
%APPDATA%\language\french.ini
%TEMP%\aut2626.tmp
%APPDATA%\language\german.ini
%TEMP%\aut26a4.tmp
%APPDATA%\language\greek.ini
%TEMP%\aut2751.tmp
%APPDATA%\language\hebrew.ini
%TEMP%\aut27cf.tmp
%APPDATA%\language\hungarian.ini
%TEMP%\aut284d.tmp
%TEMP%\aut372b.tmp
%APPDATA%\language\farsi.ini
%TEMP%\aut335c.tmp
%APPDATA%\language\italian.ini
%APPDATA%\language\korean.ini
%TEMP%\aut2998.tmp
%APPDATA%\language\polish.ini
%TEMP%\aut2a07.tmp
%APPDATA%\language\portuguese.ini
%TEMP%\aut2a65.tmp
%APPDATA%\language\romanian.ini
%TEMP%\aut2ab5.tmp
%APPDATA%\language\russian.ini
%TEMP%\aut2b42.tmp
%APPDATA%\language\spanish.ini
%TEMP%\aut2bdf.tmp
%TEMP%\aut28cb.tmp
%APPDATA%\language\japanese.ini
%TEMP%\aut291a.tmp
%TEMP%\aut163a.tmp
%TEMP%\aut379a.tmp
%TEMP%\aut40b4.tmp
%APPDATA%\wizardlanguage\kmpwiz_french.ini
%TEMP%\aut4132.tmp
%APPDATA%\wizardlanguage\kmpwiz_german.ini
%TEMP%\aut41b0.tmp
%APPDATA%\wizardlanguage\kmpwiz_greek.ini
%TEMP%\aut423e.tmp
%APPDATA%\wizardlanguage\kmpwiz_hungarian(magyar).ini
%TEMP%\aut42cc.tmp
%APPDATA%\wizardlanguage\kmpwiz_hungarian(magyar)_external.ini
%TEMP%\aut434a.tmp
%APPDATA%\wizardlanguage\kmpwiz_italian.ini
%TEMP%\aut4416.tmp
%APPDATA%\wizardlanguage\kmpwiz_japanese.ini
%APPDATA%\wizardlanguage\kmpwiz_finnish.ini
%TEMP%\aut24cc.tmp
%TEMP%\aut4046.tmp
%APPDATA%\wizardlanguage\kmpwiz_romanian(cu_diacritice).ini
%TEMP%\aut45af.tmp
%APPDATA%\wizardlanguage\kmpwiz_romanian(fara_diacritice).ini
%TEMP%\aut467b.tmp
%APPDATA%\wizardlanguage\kmpwiz_russian.ini
%TEMP%\aut46e9.tmp
%APPDATA%\wizardlanguage\kmpwiz_spanish.ini
%TEMP%\aut4767.tmp
%APPDATA%\wizardlanguage\kmpwiz_swedish.ini
%TEMP%\aut47f5.tmp
%APPDATA%\wizardlanguage\kmpwiz_thai.ini
%TEMP%\_5e74.tmp
%TEMP%\_5e84.tmp
%APPDATA%\wizardlanguage\kmpwiz_polish.ini
%TEMP%\aut44c3.tmp
%TEMP%\aut253a.tmp
%TEMP%\aut3fe7.tmp
%TEMP%\aut3c37.tmp
%APPDATA%\shader\sphere.txt
%TEMP%\aut38b5.tmp
%APPDATA%\shader\spotlight.txt
%TEMP%\aut3923.tmp
%APPDATA%\shader\undot.txt
%TEMP%\aut39c1.tmp
%APPDATA%\shader\unsharp mask.txt
%TEMP%\aut3a2f.tmp
%APPDATA%\shader\wave.txt
%TEMP%\aut3a9d.tmp
%APPDATA%\skins\default.ksf
%TEMP%\aut3b4a.tmp
%APPDATA%\wizardlanguage\kmpwiz_albanian.ini
%APPDATA%\wizardlanguage\kmpwiz_farsi.ini
%APPDATA%\shader\sharpen_5x5.txt
%TEMP%\aut3847.tmp
%APPDATA%\wizardlanguage\kmpwiz_brazilian_portuguese.ini
%TEMP%\aut3ca5.tmp
%APPDATA%\wizardlanguage\kmpwiz_bulgarian.ini
%TEMP%\aut3d52.tmp
%APPDATA%\wizardlanguage\kmpwiz_catal.ini
%TEMP%\aut3dc0.tmp
%APPDATA%\wizardlanguage\kmpwiz_chinese_simple.ini
%TEMP%\aut3e9c.tmp
%APPDATA%\wizardlanguage\kmpwiz_chinese_traditional.ini
%TEMP%\aut3efb.tmp
%APPDATA%\wizardlanguage\kmpwiz_english_external.ini
%TEMP%\aut3f79.tmp
%APPDATA%\wizardlanguage\kmpwiz_estonian.ini
%APPDATA%\wizardlanguage\kmpwiz_bosanski.ini
%TEMP%\aut3bc8.tmp
%APPDATA%\language\englishuk.ini
%TEMP%\aut243e.tmp
%APPDATA%\language\english.ini
%APPDATA%\gpl.txt
%TEMP%\autff7f.tmp
%APPDATA%\iconv.dll
%TEMP%\aut4b.tmp
%APPDATA%\imloader.dll
%TEMP%\autf8.tmp
%APPDATA%\kiconlib.dll
%TEMP%\aut1f3.tmp
%APPDATA%\kmpalbumart.dll
%TEMP%\aut3b9.tmp
%APPDATA%\kmplayer.exe
%TEMP%\aut81f.tmp
%TEMP%\autff00.tmp
%TEMP%\autfd80.tmp
%TEMP%\autff4f.tmp
%APPDATA%\kmpsetup.exe
%APPDATA%\lgpl.txt
%TEMP%\aut9d7.tmp
%APPDATA%\liba52.dll
%TEMP%\auta07.tmp
%APPDATA%\libcodec.dll
%TEMP%\autd35.tmp
%APPDATA%\libdts.dll
%TEMP%\autd74.tmp
%APPDATA%\libfaac.dll
%TEMP%\autdb4.tmp
%APPDATA%\libfaad2.dll
%TEMP%\aute60.tmp
%TEMP%\aut968.tmp
%APPDATA%\kmp_album_art.swf
%TEMP%\aut998.tmp
%TEMP%\_5e85.tmp
%APPDATA%\libmad.dll
%APPDATA%\dtview.dll
%TEMP%\autfbf2.tmp
%APPDATA%\aboutdll.dll
%TEMP%\autfc03.tmp
%APPDATA%\ac3filter.ax
%TEMP%\autfc81.tmp
%APPDATA%\audioswitcher.ax
%TEMP%\autfcc0.tmp
%APPDATA%\avisplitter.ax
%TEMP%\autfd3e.tmp
%APPDATA%\bass.dll
%TEMP%\autfd5e.tmp
%APPDATA%\bass_alac.dll
%TEMP%\autfd6f.tmp
%TEMP%\autfeef.tmp
%APPDATA%\files.txt
%APPDATA%\bass_ape.dll
%TEMP%\autfda0.tmp
%APPDATA%\bass_mpc.dll
%TEMP%\autfdc0.tmp
%APPDATA%\bass_tta.dll
%TEMP%\autfdd1.tmp
%APPDATA%\bass_wv.dll
%TEMP%\autfdf1.tmp
%APPDATA%\colortheme.ini
%TEMP%\autfe02.tmp
%APPDATA%\diracsplitter.ax
%TEMP%\autfe70.tmp
%APPDATA%\dsmsplitter.ax
%TEMP%\autfebf.tmp
%APPDATA%\aac_parser.ax
%APPDATA%\bass_flac.dll
%TEMP%\aut4521.tmp
%TEMP%\auteee.tmp
%APPDATA%\libmplay.dll
%TEMP%\aut1df5.tmp
%APPDATA%\theora.dll
%TEMP%\aut1e44.tmp
%APPDATA%\uninstall.exe
%TEMP%\aut1e84.tmp
%APPDATA%\unrardll.dll
%TEMP%\aut1f21.tmp
%APPDATA%\urllist.txt
%TEMP%\aut1faf.tmp
%APPDATA%\xviddll.dll
%TEMP%\aut203c.tmp
%APPDATA%\language\albanian.ini
%TEMP%\aut20ab.tmp
%APPDATA%\libmpeg2.dll
%APPDATA%\roqsplitter.ax
%TEMP%\aut1d68.tmp
%TEMP%\aut2197.tmp
%APPDATA%\language\brazilian portuguese.ini
%TEMP%\aut2225.tmp
%APPDATA%\language\bulgarian.ini
%TEMP%\aut2293.tmp
%APPDATA%\language\chinesebig5.ini
%TEMP%\aut22d3.tmp
%APPDATA%\language\chinesesimp.ini
%TEMP%\aut2331.tmp
%APPDATA%\language\czech.ini
%TEMP%\aut2380.tmp
%APPDATA%\language\dutch.ini
%TEMP%\aut23c0.tmp
%APPDATA%\language\arabic.ini
%APPDATA%\language\belarusian.ini
%TEMP%\autf6c.tmp
%TEMP%\aut2129.tmp
%APPDATA%\flvsplitter.ax
%TEMP%\aut1029.tmp
%APPDATA%\matroskasplitter.ax
%TEMP%\aut1191.tmp
%APPDATA%\mediainfo.dll
%TEMP%\aut1347.tmp
%APPDATA%\mmswitch.ax
%TEMP%\aut13b6.tmp
%APPDATA%\mp4splitter.ax
%TEMP%\aut1463.tmp
%APPDATA%\mpadecfilter.ax
%TEMP%\aut154e.tmp
%APPDATA%\mpasplitter.ax
%TEMP%\aut15cc.tmp
%APPDATA%\realaac.dll
%APPDATA%\realmediasplitter.ax
%TEMP%\aut1cda.tmp
%TEMP%\aut16c8.tmp
%APPDATA%\nutsplitter.ax
%TEMP%\aut1765.tmp
%APPDATA%\oggsplitter.ax
%TEMP%\aut1822.tmp
%APPDATA%\oggvorbis.dll
%TEMP%\aut18fe.tmp
%APPDATA%\old_quartz.dll
%TEMP%\aut19aa.tmp
%APPDATA%\pprocdll.dll
%TEMP%\aut1b13.tmp
%APPDATA%\qscl.dll
%TEMP%\aut1c6c.tmp
%APPDATA%\mpeg2decfilter.ax
%APPDATA%\mpegsplitter.ax
%TEMP%\_5e96.tmp

Deletes the following files

%TEMP%\autfbd2.tmp
%TEMP%\aut36bd.tmp
%TEMP%\aut364f.tmp
%TEMP%\aut3515.tmp
%TEMP%\aut3497.tmp
%TEMP%\aut340a.tmp
%TEMP%\aut33ab.tmp
%TEMP%\aut335c.tmp
%TEMP%\aut32ed.tmp
%TEMP%\aut31f2.tmp
%TEMP%\aut3155.tmp
%TEMP%\aut2f02.tmp
%TEMP%\aut2ea4.tmp
%TEMP%\aut2e35.tmp
%TEMP%\aut2d69.tmp
%TEMP%\aut372b.tmp
%TEMP%\aut2cdb.tmp
%TEMP%\aut2bdf.tmp
%TEMP%\aut2b42.tmp
%TEMP%\aut2ab5.tmp
%TEMP%\aut2a65.tmp
%TEMP%\aut2a07.tmp
%TEMP%\aut2998.tmp
%TEMP%\aut291a.tmp
%TEMP%\aut28cb.tmp
%TEMP%\aut284d.tmp
%TEMP%\aut27cf.tmp
%TEMP%\aut2751.tmp
%TEMP%\aut26a4.tmp
%TEMP%\aut2626.tmp
%TEMP%\aut25b8.tmp
%TEMP%\aut2c4e.tmp
%TEMP%\aut379a.tmp
%TEMP%\aut3847.tmp
%TEMP%\aut38b5.tmp
%TEMP%\aut41b0.tmp
%TEMP%\aut423e.tmp
%TEMP%\aut42cc.tmp
%TEMP%\aut434a.tmp
%TEMP%\aut4416.tmp
%TEMP%\aut44c3.tmp
%TEMP%\aut45af.tmp
%TEMP%\_5e85.tmp
%TEMP%\aut467b.tmp
%TEMP%\aut46e9.tmp
%TEMP%\aut4767.tmp
%TEMP%\aut47f5.tmp
%TEMP%\_5e74.tmp
%TEMP%\_5e84.tmp
%TEMP%\aut4132.tmp
%TEMP%\aut40b4.tmp
%TEMP%\aut4046.tmp
%TEMP%\aut3fe7.tmp
%TEMP%\aut3f79.tmp
%TEMP%\aut3efb.tmp
%TEMP%\aut3e9c.tmp
%TEMP%\aut3dc0.tmp
%TEMP%\aut3d52.tmp
%TEMP%\aut3ca5.tmp
%TEMP%\aut3c37.tmp
%TEMP%\aut3bc8.tmp
%TEMP%\aut3b4a.tmp
%TEMP%\aut3a9d.tmp
%TEMP%\aut3a2f.tmp
%TEMP%\aut39c1.tmp
%TEMP%\aut3923.tmp
%TEMP%\aut253a.tmp
%TEMP%\aut4521.tmp
%TEMP%\aut24cc.tmp
%TEMP%\aut20ab.tmp
%TEMP%\autd74.tmp
%TEMP%\autd35.tmp
%TEMP%\auta07.tmp
%TEMP%\aut9d7.tmp
%TEMP%\aut998.tmp
%TEMP%\aut968.tmp
%TEMP%\aut81f.tmp
%TEMP%\aut3b9.tmp
%TEMP%\aut1f3.tmp
%TEMP%\autf8.tmp
%TEMP%\aut4b.tmp
%TEMP%\autff7f.tmp
%TEMP%\autff4f.tmp
%TEMP%\autff00.tmp
%TEMP%\autdb4.tmp
%TEMP%\autfeef.tmp
%TEMP%\autfe70.tmp
%TEMP%\autfe02.tmp
%TEMP%\autfdf1.tmp
%TEMP%\autfdd1.tmp
%TEMP%\autfdc0.tmp
%TEMP%\autfda0.tmp
%TEMP%\autfd80.tmp
%TEMP%\autfd6f.tmp
%TEMP%\autfd5e.tmp
%TEMP%\autfd3e.tmp
%TEMP%\autfcc0.tmp
%TEMP%\autfc81.tmp
%TEMP%\autfc03.tmp
%TEMP%\autfbf2.tmp
%TEMP%\autfebf.tmp
%TEMP%\aute60.tmp
%TEMP%\auteee.tmp
%TEMP%\autf6c.tmp
%TEMP%\aut1df5.tmp
%TEMP%\aut1e44.tmp
%TEMP%\aut1e84.tmp
%TEMP%\aut1f21.tmp
%TEMP%\aut1faf.tmp
%TEMP%\aut203c.tmp
%TEMP%\aut2129.tmp
%TEMP%\aut23c0.tmp
%TEMP%\aut2197.tmp
%TEMP%\aut2225.tmp
%TEMP%\aut2293.tmp
%TEMP%\aut22d3.tmp
%TEMP%\aut2331.tmp
%TEMP%\aut2380.tmp
%TEMP%\aut1d68.tmp
%TEMP%\aut1cda.tmp
%TEMP%\aut1c6c.tmp
%TEMP%\aut1b13.tmp
%TEMP%\aut19aa.tmp
%TEMP%\aut18fe.tmp
%TEMP%\aut1822.tmp
%TEMP%\aut1765.tmp
%TEMP%\aut16c8.tmp
%TEMP%\aut163a.tmp
%TEMP%\aut15cc.tmp
%TEMP%\aut154e.tmp
%TEMP%\aut1463.tmp
%TEMP%\aut13b6.tmp
%TEMP%\aut1347.tmp
%TEMP%\aut1191.tmp
%TEMP%\aut1029.tmp
%TEMP%\aut243e.tmp
%TEMP%\_5e96.tmp

Network activity

TCP

HTTP GET requests

http://lo#.##player.com/kmp?en####################################################################################
http://www.km###yer.com/down/kmpver.txt
http://im####.pandora.tv/pan_img/KMP/Download/kmpver.txt
http://cd#.##player.com/KMP/Download/kmpconfig.txt
http://www.km###yer.com/down/kmp.exe
http://im####.pandora.tv/pan_img/KMP/Download/kmp.exe

UDP

DNS ASK lo#.##player.com
DNS ASK km###yer.com
DNS ASK im####.pandora.tv
DNS ASK cd#.##player.com

Miscellaneous

Searches for the following windows

ClassName: 'TKMPMSNPopUp' WindowName: ''

Creates and executes the following

'%APPDATA%\kmplayer.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней